AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-10-14 07:46 UTC
  • Importiert: 2026-10-20 11:59 UTC
  • CVSS: 8.8
  • Quelle-ID: thn_global
  • uid_hash: d50dc77ccc380aed77167faf711159114b3e72f54a7e48f5eee8db9daddccdf0

Inhalt

A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine.

The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-74580

HIGH

8.8

HIGH

8.8

2026-08-21

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

security_news - de https://feeds.feedburner.com/TheHackersNews