CVE-2026-74580
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability was found in the Linux kernel's vhost subsystem. The vring metadata cache (vq->meta_iotlb[]) is not reset when the vring is reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a device IOTLB is attached. This can lead to stale mappings being used, resulting in memory access outside the actually mapped region.
Risk Assessment
An attacker could exploit this to read or write outside the mapped memory region, potentially leading to data integrity compromise, privilege escalation, or information disclosure. The vulnerability affects systems with virtualization and vhost enabled.
Recommendation
Apply the kernel patch that resets the vring metadata cache on every vring reconfiguration immediately. Monitor your distribution for updates and deploy them as soon as possible.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99215Unknown
In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).
- CVE-2026-99210Unknown
In the Linux kernel accel/rocket driver, rocket_probe() stores the return value of rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. On failure rdev remains an ERR_PTR, and a later probe can skip initialization and dereference the error pointer when reading rdev->num_cores.
- CVE-2026-99209Unknown
In the Linux kernel drm/xe driver, xe_evict_flags() reads tbo->resource->mem_type, but a BO can reach eviction with no ttm.resource, e.g. an imported dma-buf whose resource was freed during teardown. This causes a NULL pointer dereference and a kernel fault.
- CVE-2026-99208Unknown
In the Linux kernel drm/xe/oa driver, ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.
- CVE-2026-99207Unknown
In the Linux kernel's scsi: target subsystem, target_do_delayed_work() acquired delayed_cmd_lock with a plain spin_lock() without disabling interrupts, while all other acquisition sites use spin_lock_irqsave(). Since commands can now complete in interrupt context (complete_type=1 with direct_compl_supp), this can cause a deadlock when a completion arrives on the same CPU where the work item holds the lock.
- CVE-2026-99205Unknown
In the Linux kernel, a race exists in sched_change_end() with __sched_setscheduler() for queued but non-running tasks. When a task's scheduling class changes (e.g., from SCHED_OTHER to SCHED_RR), rq->next_class is not updated and the need-resched indicator is not set, causing the CPU to idle despite a runnable task being present.
- CVE-2026-99200Unknown
In the Linux kernel, the hisi_femac network driver (net: hisilicon) assigns netdev_ops only after connecting the PHY. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.
- CVE-2026-99199Unknown
In the Linux kernel, the hip04_eth network driver (net: hisilicon) calls of_phy_connect() before ndev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.
- CVE-2026-99198Unknown
In the Linux kernel, the owl_emac network driver (net: ethernet: actions) calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.
- CVE-2026-99197Unknown
In the Linux kernel, the mv643xx_eth network driver connects the PHY before dev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated: if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes. With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vq_access_ok() and vq_log_used_access_ok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vq_meta_prefetch() hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps translating through the old mapping as map->addr + addr - map->start for an address the mapping no longer covers. vhost_copy_to_user() and vhost_copy_from_user() consume the result with __copy_to_user() and __copy_from_user(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps. Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlb_access_ok()'s slow path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS