OSG-SEC-2026-10-14 IMPORTANT- Linux Kernel vhost LPE- CVE-2026-74580

# OSG-SEC-2026-10-14-IMPORTANT- Linux Kernel vhost LPE- CVE-2026-74580

Dear OSG Security Contacts,

A flaw was found in the Linux kernel's vhost subsystem [1]. A public exploit is available for CVE-2026-74580 [2], which may allow an unprivileged local user to gain root privileges on an affected host. This issue is particularly relevant to OSG worker nodes where normal HTCondor or Apptainer jobs can access /dev/vhost-* device nodes.

## IMPACTED VERSIONS:

Affected systems are those running vulnerable Linux kernels with accessible vhost device nodes, including:

/dev/vhost-net
/dev/vhost-vsock
/dev/vhost-scsi
/dev/vhost-vdpa-*

Systems where these devices are exposed as 0666 (crw-rw-rw-) are of particular concern because any local user may be able to open them read/write.

Patch status varies by distribution:

Red Hat: fixes are available for most affected supported releases [2].
Debian: fixes are available for several supported releases; verify the exact kernel/package in use [3].
Ubuntu: some supported kernel variants remain vulnerable or are still in progress [4].

Because enterprise distributions backport kernel security fixes, sites should verify the vendor advisory and installed package status rather than relying only on the upstream kernel version.

## WHAT ARE THE VULNERABILITIES:

CVE-2026-74580 is a Linux kernel vhost vulnerability involving stale vring metadata during vhost reconfiguration.

A public exploit has demonstrated that an unprivileged local user with access to an affected /dev/vhost-* device may be able to obtain kernel arbitrary read/write and escalate privileges to root.

The published research also describes a separate guest-triggered virtualization escape path under specific vIOMMU and iommu_platform configurations.

## WHAT YOU SHOULD DO:

Apply the appropriate vendor kernel update and reboot into the fixed kernel.

If patching is not immediately feasible, consider the following temporary mitigation on systems where kernel-accelerated virtio is not required [1]:

1\. Add a configuration entry in /etc/modprobe.d to disable autoloading:  
\# echo "install vhost /bin/true" \> /etc/modprobe.d/disable-vhost.conf

2\. If the module is already loaded and no guests are using it, unload the vhost drivers:  
\# modprobe \-r vhost\_net vhost\_vsock vhost\_scsi vhost

Caveats: Disabling vhost prevents in-kernel acceleration for virtio networking, storage, and vsock communication, which may degrade I/O performance or cause virtual machine instances dependent on vhost devices to fail to start.

A system reboot or stopping active virtual machines is required if the driver is currently loaded and actively in use.

## REFERENCES

[1] https\://access.redhat.com/security/cve/cve-2026-74580
[2] https\://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580
[3] https\://security-tracker.debian.org/tracker/CVE-2026-74580
[4] https\://ubuntu.com/security/CVE-2026-74580
[5] https\://openwall.com/lists/oss-security/2026/10/14/2

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team

## PUBLICATION DATE: 10/14/2026