Vghost Linux kernel flaw gives local users root and breaks VM isolation

A flaw in Linux's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, lets a local user read and write kernel memory at will and gain root. In one virtualization setup, an untrusted VM can write to host memory and hijack the hypervisor process. The bug affects nearly a decade of kernel versions and was found by Tencent Zhuque Lab.

• Flaw tracked as CVE-2026-74580 and named Vghost
• Local user can read/write kernel memory and become root
• Untrusted VM can break out to the host and hijack it
• Nearly a decade of Linux kernel versions affected