Memory Access Vulnerability in Linux Kernel Affecting VHOST Devices

CVE-2026-74580

What is CVE-2026-74580?

A memory access vulnerability in the Linux Kernel relates to improper cache handling during vhost device configuration. Specifically, the vhost_iotlb_map metadata cache does not reset on certain ioctl calls, leading to potential unauthorized memory access. This could cause severely unexpected behavior in vhost devices due to stale address mappings not being validated properly. The vulnerability can be exploited if the memory locations are accessed after reconfiguration without proper validation, allowing for access to regions beyond the intended memory bounds. Proper cache reset on vring reconfiguration is crucial to ensure the integrity and security of memory operations across vhost devices.

References