CVE-2026-74580 - Vulnerability Details

- vhost: reset the vring metadata cache on vring reconfiguration

Description

In the Linux kernel, the following vulnerability has been resolved:

vhost: reset the vring metadata cache on vring reconfiguration

vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:

if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;

The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.

With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as

map->addr + addr - map->start

for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.

Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.

Published: 2026-08-21

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s vhost virtualization framework contains a flaw that fails to reset the vring metadata cache when a device IOTLB is reconfigured. This omission leads to a buffer validation (CWE‑825) weakness, allowing a local attacker to trigger out‑of‑bounds memory accesses. By issuing VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM ioctl calls while a device IOTLB is attached, the attacker can manipulate the stale cache, causing the kernel to translate a guest virtual address through an invalid mapping, corrupt kernel memory and potentially execute arbitrary code.

Affected Systems

All Linux kernel builds that include the vhost module and use device IOTLBs are potentially affected. The vulnerability is not tied to a specific release number; any recent kernel containing the unpatched vhost code that performs VRing reconfiguration while a device IOTLB is attached is vulnerable.

Risk and Exploitability

The likely attack vector is the local ioctl interface to vhost devices, requiring the attacker to have the ability to send ioctl requests to the device. No publicly available exploits have been reported. The EPSS score is < 1%, indicating a very low probability of exploitation; the CVSS score of 8.8 indicates high severity. The risk is moderate to high for systems that can interact with vhost devices and perform VRing reconfigurations. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< 5224bd37e37d36076a550d99b2aebba33939fd95
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< 54617e9119be2eb728ecdd8d977b99c99d4c498a
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< 13fa6f32a56a386a82bd7451644c494beed034af
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< 6fa3e9b1fe856259555a7e22f3f3082e7827fd9b
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< b70ebe0bba254e093dd5fd4c0c170941ce83eb85
`f889491380582b4ba2981cf0b0d7d6a40fb30ab7`	affected	< de845981da67a6b049080c87e605130b0c30adc5

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f889491380582b4ba2981cf0b0d7d6a40fb30ab7,5224bd37e37d36076a550d99b2aebba33939fd95)`	affected	code_commit	—
`[5224bd37e37d36076a550d99b2aebba33939fd95,54617e9119be2eb728ecdd8d977b99c99d4c498a)`	affected	code_commit	—
`[54617e9119be2eb728ecdd8d977b99c99d4c498a,13fa6f32a56a386a82bd7451644c494beed034af)`	affected	code_commit	—
`[13fa6f32a56a386a82bd7451644c494beed034af,cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7)`	affected	code_commit	—
`[cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7,6fa3e9b1fe856259555a7e22f3f3082e7827fd9b)`	affected	code_commit	—
`[6fa3e9b1fe856259555a7e22f3f3082e7827fd9b,f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6)`	affected	code_commit	—
`[f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6,b70ebe0bba254e093dd5fd4c0c170941ce83eb85)`	affected	code_commit	—
`[b70ebe0bba254e093dd5fd4c0c170941ce83eb85,de845981da67a6b049080c87e605130b0c30adc5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	generic	—
`[0,4.11)`	unaffected	semver	—
`[5.10.265,6.0.0)`	unaffected	semver	—
`[5.15.216,6.0.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch resetting the vring metadata cache on VRing reconfiguration.
If a kernel update is not immediately possible, stop the vhost device before invoking VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM, reinitialize the device, and then perform the VRing reconfiguration to force the cache reset.
Disable the vhost module or avoid using device IOTLBs on affected kernels until the patch is applied.

Generated by OpenCVE AI on August 25, 2026 at 06:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00121.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af
https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95
https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a
https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b
https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85
https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7
https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5
https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6
https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74580
https://www.cve.org/CVERecord?id=CVE-2026-74580

History

Tue, 25 Aug 2026 05:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Sat, 22 Aug 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-665

Sat, 22 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74580 https://www.cve.org/CVERecord?id=CVE-2026-74580
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 21 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-665

Fri, 21 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated: if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes. With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vq_access_ok() and vq_log_used_access_ok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vq_meta_prefetch() hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps translating through the old mapping as map->addr + addr - map->start for an address the mapping no longer covers. vhost_copy_to_user() and vhost_copy_from_user() consume the result with __copy_to_user() and __copy_from_user(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps. Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlb_access_ok()'s slow path.
Title		vhost: reset the vring metadata cache on vring reconfiguration
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95 https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85 https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7 https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5 https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-21T16:31:54.076Z

Updated: 2026-08-25T05:40:06.380Z

Reserved: 2026-08-15T05:44:03.918Z

Link: CVE-2026-74580

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-21T17:16:44.210

Modified: 2026-08-25T06:18:30.997

Link: CVE-2026-74580

Redhat

Severity : Moderate

Publid Date: 2026-08-21T00:00:00Z

Links: CVE-2026-74580 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T06:30:04Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object