A flaw in Linux’s vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host’s memory and hijack the program that runs the virtual machine.

The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the