Tencent Zhuque Lab published its Vghost disclosure on October 12, 2026, describing a Linux vhost flaw that can leave stale virtual-ring metadata cached after a live queue is reconfigured. The lab reports a local privilege-escalation path and a separate, conditional route from a virtual machine guest into host QEMU memory. The guest-to-host route depends on a virtual IOMMU, iommu_platform being enabled, and vhost running in device-IOTLB mode. Tencent Zhuque Lab’s technical disclosure
Tencent says its Corvus AI system identified the defect in two hours. The lab separately says Tencent Hunyuan Hy4-preview was used for exploit verification and patch regression analysis. Those are distinct roles in Tencent’s account of its research process.
Why vhost can reuse a stale mapping
Vghost, tracked as CVE-2026-74580, affects the Linux kernel’s vhost subsystem. The flaw is in its cache of metadata for a virtqueue, or virtual device queue. When the queue’s addresses or region sizes change, a stale cache entry can remain; a cache hit can then skip validation of the new range and allow access beyond the IOTLB mapping. Ubuntu Security’s CVE-2026-74580 advisory describes the stale-cache mechanism.
The relevant changes can arrive through VHOST_SET_VRING_ADDR, which changes ring addresses, or VHOST_SET_VRING_NUM, which changes region sizes. The upstream fix clears the metadata cache when the vring is reconfigured, so the new addresses go through the IOTLB validation path. Tencent says the flaw affects upstream Linux versions 4.11 through 7.2-rc4.
Tencent says the fix entered the Linux mainline on August 3, 2026. That is the upstream milestone; distribution kernels can incorporate the change separately.
How Tencent says a guest can reach QEMU memory
The guest-to-host route Tencent describes is conditional, not a general claim about every virtual machine. It requires a virtio device behind a virtual IOMMU, iommu_platform enabled, and vhost in device-IOTLB mode. Under those conditions, Tencent says a guest can use VIRTIO_F_RING_RESET to reset and re-enable a virtqueue. QEMU then reconfigures the live ring by issuing VHOST_SET_VRING_ADDR on the existing file descriptor, without clearing the stale cache. A later kick can reuse the old IOTLB mapping and cause an out-of-bounds write into QEMU memory, according to Tencent.
Tencent describes that sequence as a path to QEMU control-flow redirection or a process crash. The sequence is a reported technical demonstration by Tencent Zhuque Lab.
The five kernel builds Tencent tested
Tencent reports successful local privilege-escalation tests on these five distribution kernel builds. Its device-node permission observations apply to the specific test images listed, not to every installation of those distributions.
| Test distribution | Kernel build Tencent lists | /dev/vhost-vsock on the test image |
| Ubuntu 26.04 LTS | 7.0.0-28-generic | 0660 root:kvm |
| RHEL 9.8 | 5.14.0-687.5.3.el9_8.x86_64 | 0666 root:kvm |
| Amazon Linux 2023.12.20260817 | 6.1.180-225.360.amzn2023.x86_64 | 0666 root:kvm |
| Microsoft Azure Linux 3.0 | 6.6.150.1-1.azl3 | 0666 root:kvm |
| Oracle Linux 10.2 | 6.12.0-204.92.4.2.el10uek | 0666 root:kvm |
The local path requires access to an affected vhost device node. Device permissions and group membership therefore matter to that route; Tencent’s reported Ubuntu test began with a user in the kvm group.
Upstream fixed versions and Ubuntu package status
Tencent lists these first fixed upstream stable versions. Distribution vendors may backport the fix without changing the upstream version number, so administrators should also check their distribution’s package advisory.
| Upstream stable branch | First fixed version listed by Tencent |
| 5.10.y | 5.10.265 |
| 5.15.y | 5.15.216 |
| 6.1.y | 6.1.183 |
| 6.6.y | 6.6.152 |
| 6.12.y | 6.12.104 |
| 6.18.y | 6.18.45 |
| 7.1.y | 7.1.9 |
| 7.2 | 7.2 |
Ubuntu’s advisory, last updated October 13, 2026, lists the Ubuntu 22.04 linux package as fixed in 5.15.0-198.208. The same advisory lists the Ubuntu 24.04 and 26.04 linux packages as vulnerable, with work in progress. Kernel flavors such as linux-kvm, linux-aws, and linux-azure have separate package rows and statuses. Ubuntu’s package-specific advisory
Tencent recommends installing a kernel that contains the fix and rebooting into it. Until then, it recommends restricting access to vhost device nodes, removing world access, limiting the owning group to trusted virtualization services, and keeping the devices away from untrusted containers. The Hacker News reported that restricting device-node access does not provide an interim workaround for the conditional guest-to-host route; that path requires a patched kernel. Tencent Zhuque Lab and The Hacker News
