All vulnerabilities
CVE-2026-74580

Linux: vhost: reset the vring metadata cache on vring reconfiguration

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 25 Oct 2026FIRST EPSS
Fixed in5224bd37e37d36076a550d99b2aebba33939fd95Also 54617e9119be2eb728ecdd8d977b99c99d4c498a, 13fa6f32a56a386a82bd7451644c494beed034af and 1 moreCVE List
Published21 Aug 2026Updated 16 Oct 2026CVE List

What fixes it

  • 5224bd37e37d36076a550d99b2aebba33939fd95LinuxCVE List
  • 54617e9119be2eb728ecdd8d977b99c99d4c498aLinuxCVE List
  • 13fa6f32a56a386a82bd7451644c494beed034afLinuxCVE List
  • 6fa3e9b1fe856259555a7e22f3f3082e7827fd9bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 21 Aug 2026, 16:31 UTCPublishedCVE List
  2. 25 Oct 2026, 12:05 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

In the Linux kernel, the following vulnerability has been resolved:

vhost: reset the vring metadata cache on vring reconfiguration

vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated:

if (vhost_vq_meta_fetch(vq, addr, len, type)) return true;

The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes.

With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vq_access_ok() and vq_log_used_access_ok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vq_meta_prefetch() hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps translating through the old mapping as

map->addr + addr - map->start

for an address the mapping no longer covers. vhost_copy_to_user() and vhost_copy_from_user() consume the result with __copy_to_user() and __copy_from_user(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps.

Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlb_access_ok()'s slow path.

Text from CVE List

Affected versions 18

  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before 5224bd37e37d36076a550d99b2aebba33939fd95CVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before 54617e9119be2eb728ecdd8d977b99c99d4c498aCVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before 13fa6f32a56a386a82bd7451644c494beed034afCVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7CVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before 6fa3e9b1fe856259555a7e22f3f3082e7827fd9bCVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6CVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before b70ebe0bba254e093dd5fd4c0c170941ce83eb85CVE List
  • Linuxaffected: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 before de845981da67a6b049080c87e605130b0c30adc5CVE List
  • Linuxaffected: 4.11CVE List
  • Linuxunaffected: all versions before 4.11CVE List
  • Linuxunaffected: 5.10.265 through 5.10.*CVE List
  • Linuxunaffected: 5.15.216 through 5.15.*CVE List
  • Linuxunaffected: 6.1.183 through 6.1.*CVE List
  • Linuxunaffected: 6.6.152 through 6.6.*CVE List
  • Linuxunaffected: 6.12.104 through 6.12.*CVE List
  • Linuxunaffected: 6.18.45 through 6.18.*CVE List
  • Linuxunaffected: 7.1.9 through 7.1.*CVE List
  • Linuxunaffected: 7.2CVE List

References 8