{"id":"CVE-2026-74580","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok()…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok()…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < 5224bd37e37d36076a550d99b2aebba33939fd95","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < 54617e9119be2eb728ecdd8d977b99c99d4c498a","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < 13fa6f32a56a386a82bd7451644c494beed034af","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < 6fa3e9b1fe856259555a7e22f3f3082e7827fd9b","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < b70ebe0bba254e093dd5fd4c0c170941ce83eb85","Linux >= f889491380582b4ba2981cf0b0d7d6a40fb30ab7 < de845981da67a6b049080c87e605130b0c30adc5","Linux 4.11"],"published":"2026-08-21","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:39.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74580","references":[{"url":"https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/14/2","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00243,"epssPercentile":0.15458,"exploits":{"github":4,"githubRepos":["https://github.com/ABC00012345/CVE-2026-74580","https://github.com/V01DL1NG/vghost-watch","https://github.com/YounesHfa/CVE-2026-74580"],"checkedAt":"2026-10-27T20:57:13.793Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-28T00:00:00+00:00"},"ingestedAt":"2026-10-14T06:17:13.776Z","slug":"CVE-2026-74580","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time.  Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap->addr + addr - map->start\n\nfor an address the mapping no longer covers.  vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222656,"id":"CVE-2026-74580","ts":1792092438410,"field":"exploit_available","old":"false","new":"true"}]}