Loading vulnerability…
CVE-2026-74580 is a memory-access vulnerability in the Linux kernel vhost subsystem caused by failure to invalidate cached vring metadata mappings during reconfiguration. VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM change ring addresses or sizes without resetting vq->meta_iotlb[]. With a device IOTLB attached, these operations can occur while the virtqueue is live, with address validation deferred until metadata prefetch. A populated stale cache causes iotlb_access_ok() and vq_meta_prefetch() to accept the reconfigured region without validation. vhost_vq_meta_fetch() then translates addresses using an old mapping, and subsequent descriptor fetches or used-ring updates can access memory outside the region actually mapped by the IOTLB.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stale memory-mapping cache vulnerability in Linux's vhost subsystem, reported to affect kernels 4.11 through 7.2-rc4. Reconfiguring an active virtual ring without clearing cached mappings enables out-of-bounds memory access. Local users with access to vhost device nodes can obtain arbitrary kernel reads and writes, bypass KASLR, and escalate to root without timing races or memory grooming. Under specific virtual-IOMMU and device-IOTLB configurations, an untrusted guest can overwrite host QEMU process memory, hijack execution, or crash the process. Fixed kernels are available. Restricting vhost device access mitigates the local-user attack, but the article identifies no interim workaround for the guest-to-host attack.
The post describes a stale IOTLB cache vulnerability in Linux kernel vhost, claiming universal local privilege escalation and a guest-to-host escape vector. The supplied content contains only a headline, without technical evidence or verification of these claims.
A stale metadata-cache vulnerability in the Linux kernel's vhost subsystem. Reconfiguring vring addresses or sizes while a device IOTLB is attached does not invalidate cached mappings. Subsequent cache hits bypass address validation and translate addresses through outdated mappings, allowing descriptor fetches or used-ring updates to access memory outside the IOTLB-mapped region. The record assigns CVSS 3.1 severity HIGH with a score of 8.8, describing a local attack requiring low privileges and no user interaction, with high confidentiality, integrity, and availability impacts. The fix resets the metadata cache whenever a vring is reconfigured. Listed fixed releases include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2.
A Linux kernel vhost vulnerability leaves stale vring metadata cache entries after ring addresses or sizes are reconfigured. These entries bypass deferred IOTLB validation and permit subsequent descriptor fetches or used-ring updates to access memory outside the mapped region. The reference assigns a CVSS v3 score of 8.8, with local access and low privileges required and potentially high confidentiality, integrity, and availability impacts.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.