AI-Assisted Research Uncovers Linux Kernel Flaw That Could Grant Root Access and Enable Virtual Machine Escape

Cybersecurity researchers have disclosed a serious Linux kernel vulnerability that could allow local users to gain root privileges and, under certain virtualisation configurations, enable an attacker inside a virtual machine to compromise the host system.

The vulnerability, tracked as CVE-2026-74580 and named Vghost, affects Linux’s vhost subsystem, which helps improve input/output performance for virtual machines and containers.

Researchers at Tencent’s Zhuque Lab discovered the flaw and released a fix on August 3, 2026, before publishing technical details and demonstrations of its potential impact on October 12. No publicly confirmed evidence of exploitation in real-world attacks was reported in the disclosure.

The vulnerability is particularly concerning because it affects multiple generations of the Linux kernel, with researchers identifying its presence in versions dating back to Linux 4.11.

According to the findings, an attacker with local access could exploit the weakness to read and modify kernel memory, bypass Kernel Address Space Layout Randomisation (KASLR) and escalate privileges to root.

Under a more specific virtualisation configuration, the vulnerability could also allow an untrusted virtual machine to write outside an allocated memory region in the host’s QEMU process. This could potentially enable the attacker to take control of the host process or cause it to crash.

The two attack scenarios have different requirements. The local privilege-escalation issue depends on access to the affected vhost device, while the virtual machine escape requires particular virtualisation settings.

How the Vghost Vulnerability Works

The vhost subsystem handles performance-critical operations associated with virtual machine devices. It can be accessed through device files such as /dev/vhost-net and /dev/vhost-vsock, depending on the system configuration.

The flaw involves the way the subsystem caches memory mappings associated with virtual rings and shared queues used to transfer data.

Under normal circumstances, the cache helps the kernel avoid repeatedly checking memory regions that have already been validated. However, researchers found that certain changes to the addresses or sizes of active virtual rings did not properly invalidate the cached mappings.

As a result, the system could continue using outdated memory translations after the underlying configuration had changed.

When the kernel subsequently accessed memory through these stale mappings, it could read from or write to locations outside the intended memory region. This weakness created the conditions for unauthorised kernel memory access and privilege escalation.

The researchers traced the problem to changes introduced over several years. A modification in Linux 4.11 added the caching mechanism, while another change in Linux 5.9 moved address validation to a later stage of processing. According to the analysis, the combination left a gap that allowed outdated mappings to remain usable.

Virtual Machine Escape Risk

The second attack path involves environments where a virtual machine’s virtio device operates behind a virtual I/O memory management unit, or IOMMU, with iommu_platform enabled and vhost running in device-IOTLB mode.

In this configuration, an attacker controlling an untrusted guest could exploit the flaw to cause an out-of-bounds write affecting the host’s QEMU process.

QEMU is commonly used to run and manage virtual machines. If an attacker successfully corrupts its memory, the consequences could extend beyond the guest environment, potentially compromising the host process or disrupting the virtual machine service.

Such an attack is particularly relevant to organisations that operate virtualisation infrastructure, cloud platforms and systems hosting workloads from multiple users.

However, the guest-to-host attack depends on the specific configuration described by the researchers and should not be interpreted as a universal escape affecting every Linux virtual machine.

Linux Distributions and Versions Affected

The vulnerability affects Linux kernels beginning with version 4.11 and extending through 7.2-rc4, according to the disclosure.

Tencent’s researchers reproduced the local privilege-escalation attack on several distribution kernels, including Ubuntu 26.04, Red Hat Enterprise Linux 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0 and Oracle Linux 10.2.

The level of exposure varied according to device permissions. On the tested Ubuntu configuration, access to the relevant device node was restricted to members of the kvm group, meaning an attacker would need the required group access.

On the other four tested systems, the researchers found that the relevant device node was readable and accessible to all local users under the tested configurations.

These findings highlight why organisations should examine both their installed kernel versions and the permissions assigned to virtualisation devices.

Security Fixes Released

The vulnerability has been addressed through an upstream Linux kernel change identified as de845981da67. The correction clears the affected cache whenever the virtual ring is reconfigured, preventing the kernel from continuing to rely on outdated memory mappings.

The first fixed upstream stable releases listed in the disclosure are:

• Linux 5.10.265
• Linux 5.15.216
• Linux 6.1.183
• Linux 6.6.152
• Linux 6.12.104
• Linux 6.18.45
• Linux 7.1.9
• Linux 7.2

Organisations should confirm the status of their particular distribution because vendors can backport security fixes without changing the kernel version to match the upstream release numbers.

The report said Red Hat, Amazon Linux and Oracle Linux had shipped fixes. Ubuntu had addressed the issue in its 22.04 series, while its 24.04 and 26.04 kernel updates were still listed as in progress as of October 13, 2026.

Administrators should consult their distribution’s official security advisory to determine which package contains the correction.

Until a patched kernel is installed, administrators can reduce exposure by restricting access to /dev/vhost-net and /dev/vhost-vsock, removing unnecessary access for ordinary users and limiting membership in the groups permitted to use these devices.

However, these measures are interim precautions rather than a complete solution. The researchers said there was no temporary workaround for the guest-to-host escape path, making installation of a patched kernel the necessary remedy.

Severity Ratings Differ Across Security Authorities

The vulnerability has received high-severity ratings, although security organisations differ in their assessments of its overall impact.

The kernel.org CVE team assigned it a score of 8.8, taking into account the potential for the virtual machine escape to affect the host’s QEMU process across a security boundary.

Red Hat assigned a score of 7.3 and assessed the scope differently, while Amazon Linux gave it a score of 7.8 and Oracle Linux rated it 7.3.

These differences reflect variations in how the organisations assess exploit conditions, system impact and the security boundaries involved. Regardless of the precise rating, the ability to obtain root privileges or potentially compromise a virtualisation host makes the vulnerability important for affected administrators to address.

AI System Assisted the Discovery

The flaw was discovered with assistance from Corvus AI, a multi-agent system developed by Tencent for Linux kernel vulnerability research.

The upstream fix acknowledges the system’s contribution, and Tencent said its research pipeline helped identify the weakness.

The disclosure demonstrates how AI-assisted analysis can support security researchers examining complex operating-system code and identifying problems that may remain hidden for years.

However, the discovery does not mean an autonomous AI system independently carried out a cyberattack. Rather, the technology was used as part of a vulnerability research process that resulted in a fix being made available.

The same research pipeline was previously associated with the discovery of an 18-year-old Linux kernel vulnerability involving the Stream Control Transmission Protocol, or SCTP, which was disclosed in August 2026.

The Vghost case reinforces the importance of continued kernel security research, timely patching and careful access control across virtualisation environments.

For organisations running Linux servers, cloud workloads or virtual machines, the immediate priority is to verify whether their systems are affected, install the appropriate vendor-provided updates and review access to vhost devices. These measures can help reduce the risk of local privilege escalation and potential compromise of virtualisation hosts.