Improper access control in Linux kernel - CVE-2026-74580

Vulnerability details

The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.

The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.

The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.

Affected software

How to mitigate CVE-2026-74580

External References

• https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af
• https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95
• https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a
• https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b
• https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85
• https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7
• https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5
• https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6

Related Security Bulletins

• Improper access control in Linux kernel vhost driver
• Debian update for linux