Vghost: A Nine-Year-Old Linux vhost Bug Gives Local Users Root and Lets Guests Hit the Host
No Comments on Vghost: A Nine-Year-Old Linux vhost Bug Gives Local Users Root and Lets Guests Hit the Host
CVE-2026-74580, nicknamed Vghost, is a stale-cache bug in Linux's vhost subsystem that gives local users root and, in one setup, lets a guest VM attack the host's QEMU process. Here is what's reported, who is exposed, and what to do now.