CVE-2026-74580: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74580 is a stale cache / expired pointer dereference vulnerability in the Linux kernel's vhost driver, specifically in the vring metadata cache (vq->meta_iotlb[]). The flaw allows a local user with access to vhost device ioctls to read from or write to unintended kernel memory regions by exploiting stale IOTLB cache entries after vring reconfiguration. It affects Linux kernel versions from 4.11 up to (but not including) the fixed stable releases: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. The vulnerability was published on August 21, 2026, and is classified as Medium severity with an EPSS score of approximately 0.165% (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-825 (Expired Pointer Dereference): the vq->meta_iotlb[] cache stores vhost_iotlb_map entries that back each vring metadata region, and iotlb_access_ok() returns early on a cache hit without re-validating the mapping. The cache is correctly invalidated on VHOST_IOTLB_UPDATE, VHOST_IOTLB_INVALIDATE, device IOTLB (re)initialization, and vq reset — but critically, it is not reset when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail, and vq->used, nor when VHOST_SET_VRING_NUM changes ring sizes. With a device IOTLB attached, both ioctls are accepted on a live queue and defer address validation to prefetch time; once the cache is populated, vq_meta_prefetch() hits the stale entry and skips re-validation, causing vhost_vq_meta_fetch() to compute map->addr + addr - map->start for an address the mapping no longer covers. The resulting incorrect physical address is then consumed by vhost_copy_to_user() / vhost_copy_from_user() via __copy_to_user() / __copy_from_user() without further bounds checking (GitHub Advisory, Red Hat Bugzilla).

A local user with access to vhost device ioctls — typically a process operating within a virtualized guest environment using device IOTLB — can exploit stale cache entries to read arbitrary kernel memory (information disclosure) or write data to unintended memory locations (memory corruption). Successful exploitation could expose sensitive kernel data, corrupt ring buffer state, or potentially be chained with other vulnerabilities for privilege escalation within the host kernel. The scope is limited to systems where vhost devices with IOTLB are in use, such as QEMU/KVM-based virtualization environments (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability requires local access to vhost device ioctls, which significantly limits the attack surface to privileged or semi-privileged local users in virtualization contexts. The EPSS score is approximately 0.165% (6th percentile), indicating a low near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been identified.

1. Gain local access: Obtain a local user account or process with access to a vhost device (e.g., /dev/vhost-net) on a system running a QEMU/KVM guest with device IOTLB enabled.
2. Populate the vring metadata cache: Perform normal vhost operations to trigger vq_meta_prefetch(), causing vq->meta_iotlb[] to be populated with valid IOTLB mappings for the current vring addresses.
3. Reconfigure the vring while live: Issue a VHOST_SET_VRING_ADDR ioctl to replace vq->desc, vq->avail, and/or vq->used with new Guest I/O Virtual Addresses (GIOVAs), or issue VHOST_SET_VRING_NUM to change ring sizes — without triggering a vq reset or IOTLB invalidation.
4. Exploit stale cache entries: Trigger subsequent vhost operations (e.g., used ring updates or descriptor fetches) that call iotlb_access_ok(). The function returns early on the stale cache hit, and vhost_vq_meta_fetch() computes an incorrect physical address (map->addr + addr - map->start) for the new GIOVA using the old mapping.
5. Achieve out-of-bounds memory access: The incorrect address is passed to __copy_to_user() or __copy_from_user(), resulting in reads from or writes to kernel memory outside the intended IOTLB-mapped region, enabling memory disclosure or corruption (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg) showing unexpected memory access errors, IOTLB faults, or vhost-related warnings (e.g., vhost_copy_to_user/vhost_copy_from_user errors) following vring reconfiguration events.
• Process Behavior: Unusual sequences of VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM ioctl calls on a live vhost queue without corresponding vq reset or IOTLB invalidation, detectable via strace or auditd ioctl auditing on /dev/vhost-net or similar devices.
• System: Unexpected kernel panics, memory corruption symptoms, or anomalous data appearing in vring descriptor/used ring buffers in a QEMU/KVM guest environment.

Apply the upstream kernel patches that reset vq->meta_iotlb[] whenever VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM ioctls are called. Fixed versions are available in stable branches: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2 (GitHub Advisory). Patch commits are available at the kernel stable repository for each affected branch. As a workaround, restrict access to vhost device ioctls to trusted processes only (e.g., via strict file permissions on /dev/vhost-* and use of seccomp/SELinux/AppArmor policies), and isolate vhost device usage in confined guest environments where possible (Red Hat Bugzilla).

Red Hat has filed a Medium-severity bug (Bug 2521055) tracking this CVE against their kernel component, with upstream advisory referenced from the linux-cve-announce mailing list (Red Hat Bugzilla). No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database aggregation.