[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-JyJeaRh3SpR3aT5mZKwy161IpIHJ6dbITl5-Mra9RE":3},{"article":4,"iocs":42,"watch_terms":47,"solutions":48,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"1073dfb6-016a-43b1-96f2-744733b8a84e","AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host","ai-found-linux-kernel-flaw-gives-local-users-root-and-can-break-a-guest-out-to-t-dce2d9","A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the","A vulnerability in Linux's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local users to read and write kernel memory, granting them root privileges. This flaw affects nearly a decade of kernel versions. In specific virtualization configurations, it can enable an untrusted virtual machine to write to the host's memory and hijack the virtual machine's execution program.","Linux kernel flaw allows local users root access and VM escapes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fai-found-linux-kernel-flaw-gives-local.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhavZnpNnmOBy6Wnkh7wfYD4-I32k65R7uyhYW32Doh3YVqtfJaagZZ_uo9JN-cixODo6h846eR89Aa55TGuMKfXmpjZEVZQ0ssFoP4-qVX6qrvSoyfRsu_q3MQcLKwolyKeE3Lw3MByz2Su8O0XOdRWNkJmyBdwpxsAtxi5y2goE7RhOSBPOLh4Evb60c\u002Fs1600\u002Flinux-exploit.jpg","2026-10-14T07:46:57+00:00","2026-10-14T10:00:14.308499+00:00",9,[17,20,23,26],{"name":18,"type":19},"Linux kernel","product",{"name":21,"type":22},"vhost subsystem","technology",{"name":24,"type":25},"Tencent","vendor",{"name":27,"type":28},"Tencent Zhuque Lab","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43],{"type":44,"value":45,"context":46},"cve","CVE-2026-74580","Linux kernel vulnerability Vghost",[24,18],{"controls":49,"vendors":137},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"patch-management","Automated patch management","Known holes get closed in days, not months.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":109,"name":110,"problem":111,"products":112},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":154},"linux-kernel-vhost-flaw-grants-root-and-enables-vm-escape","Linux Kernel vhost Flaw Grants Root and Enables VM Escape","A critical privilege escalation vulnerability (CVE-2026-74580, 'Vghost') in the Linux kernel's vhost subsystem allows local users to read and write arbitrary kernel memory, effectively granting themselves root privileges. What makes this flaw especially dangerous is its virtualization breakout potential: in certain configurations, an untrusted guest VM can write directly to host memory and hijack the hypervisor's execution flow, collapsing the fundamental security boundary between virtual machines and their host. The flaw affects nearly a decade of kernel versions, meaning a vast number of unpatched systems across cloud, on-premises, and embedded environments are exposed. This highlights how low-level kernel vulnerabilities discovered through AI-assisted analysis can have cascading consequences across entire infrastructure stacks.",[143,144,145,146,147,148,149,150,151,152,153],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 12: Network Infrastructure Management","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-125: Guide to Security for Full Virtualization Technologies","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","ITIL Change Management: Emergency Change procedures for critical patches","GDPR Article 32: Security of processing (technical measures to ensure system integrity)",{}]