AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
Linux kernel flaw allows local users root access and VM escapes.
Run Tencent?
Get an email when a reviewed story names Tencent, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A vulnerability in Linux's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local users to read and write kernel memory, granting them root privileges. This flaw affects nearly a decade of kernel versions. In specific virtualization configurations, it can enable an untrusted virtual machine to write to the host's memory and hijack the virtual machine's execution program.
The lesson from this incident
Full lessonA critical privilege escalation vulnerability (CVE-2026-74580, 'Vghost') in the Linux kernel's vhost subsystem allows local users to read and write arbitrary kernel memory, effectively granting themselves root privileges. What makes this flaw especially dangerous is its virtualization breakout potential: in certain configurations, an untrusted guest VM can write directly to host memory and hijack the hypervisor's execution flow, collapsing the fundamental security boundary between virtual machines and their host. The flaw affects nearly a decade of kernel versions, meaning a vast number of unpatched systems across cloud, on-premises, and embedded environments are exposed. This highlights how low-level kernel vulnerabilities discovered through AI-assisted analysis can have cascading consequences across entire infrastructure stacks.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
- cve — CVE-2026-74580