Improper access control in Linux kernel - CVE-2026-74580

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU144981

Improper access control in Linux kernel - CVE-2026-74580

Published: August 24, 2026


Vulnerability identifier: #VU144981
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74580
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.

The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.

The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.


Affected software

Linux kernel
Debian Linux
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
kernel (Red Hat package)
linux (Debian package)

How to mitigate CVE-2026-74580

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel (Red Hat package) - update to 5.14.0-570.138.1.el9_6
linux (Debian package) - update to 6.12.105-1

External References

Related Security Bulletins