Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector
LinuxkernelvulnerabilityCVEprivilege escalationguest-to-hostvhostIOTLBsecurityvirtualization
The Reddit post references a security vulnerability designated CVE-2026-74580, nicknamed Vghost, which involves a stale IOTLB cache issue in the Linux kernel's vhost component. According to the post title, this vulnerability enables both universal local privilege escalation (LPE) and guest-to-host escape attacks. The post links to an OpenWall oss-security mailing list entry dated October 14, 2026.