CVE-2026-74580 (GCVE-0-2026-74580)
Vulnerability from cvelistv5
Published
2026-08-21 16:31
Modified
2026-08-25 05:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost: reset the vring metadata cache on vring reconfiguration
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5224bd37e37d36076a550d99b2aebba33939fd95",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "54617e9119be2eb728ecdd8d977b99c99d4c498a",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "13fa6f32a56a386a82bd7451644c494beed034af",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "6fa3e9b1fe856259555a7e22f3f3082e7827fd9b",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "b70ebe0bba254e093dd5fd4c0c170941ce83eb85",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "de845981da67a6b049080c87e605130b0c30adc5",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq-\u003emeta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq-\u003edesc, vq-\u003eavail and vq-\u003eused, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time. Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap-\u003eaddr + addr - map-\u003estart\n\nfor an address the mapping no longer covers. vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()\u0027s slow path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires ioctl on /dev/vhost-net or /dev/vhost-vsock (VHOST_SET_OWNER, VHOST_SET_FEATURES with VIRTIO_F_ACCESS_PLATFORM, VHOST_SET_VRING_ADDR, IOTLB updates); although virtio kicks and network I/O trigger the corrupting copies, the stale-cache state is created only through local vhost character-device syscalls, not remote packets.\nAC:L - An attacker who controls the vhost owner process can deterministically populate meta_iotlb via normal virtqueue traffic, issue VHOST_SET_VRING_ADDR with new GIOVAs while the backend is live, then trigger descriptor/used-ring access; no races, special heap layout, or victim timing are required.\nPR:L - No host root is needed: exploitation is performed by the vhost device owner (standard libvirt/QEMU kvm-group account) or, in the highest-impact cloud scenario, an authorized malicious VM tenant whose virtio traffic drives vhost workers after QEMU updates live vring addresses under VIRTIO_F_ACCESS_PLATFORM.\nUI:N - No end-user or administrator action is required beyond routine automated VM operation (virtio I/O, vhost backend attachment, and vring setup) that the attacker or tenant controls directly.\nS:C - Stale IOTLB metadata translation makes the host kernel read/write outside the mapped vring regions in the VMM userspace address space (QEMU), crossing the guest-to-host virtualization boundary\u2014the same escape class as CVE-2025-38074, not mere in-guest kernel impact.\nC:H - vhost_copy_from_user and __vhost_get_user use vhost_vq_meta_fetch\u0027s stale map-\u003eaddr+addr-map-\u003estart translation without bounds checks, enabling out-of-bounds reads of adjacent VMM memory during descriptor and avail-ring fetches (arbitrary misdirected kernel reads from host userspace).\nI:H - vhost_copy_to_user and vhost_put_user write used-ring entries through the same stale translation, giving controlled out-of-bounds writes into the VMM process that can corrupt QEMU heap, IOTLB tables, or migration metadata for code-execution primitives.\nA:H - Misdirected __copy_to_user/__copy_from_user against unmapped or invalid VMM addresses can fault the vhost worker (host kernel oops/panic), and corrupting VMM control structures reliably crashes or kills the hypervisor process, terminating the VM."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:06.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95"
},
{
"url": "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a"
},
{
"url": "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af"
},
{
"url": "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7"
},
{
"url": "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b"
},
{
"url": "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6"
},
{
"url": "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85"
},
{
"url": "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5"
}
],
"title": "vhost: reset the vring metadata cache on vring reconfiguration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74580",
"datePublished": "2026-08-21T16:31:54.076Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-08-25T05:40:06.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…