Linux Kernel: 1 AI-Discovered Flaw Gives Local Users Root and Lets VMs Escape to the Host

Tencent Zhuque Lab disclosed on October 12, 2026 that its Corvus AI multi-agent system discovered a high-severity memory corruption vulnerability in the Linux kernel's vhost virtualization acceleration subsystem, tracked as CVE-2026-74580 and named "Vghost," which allows an unprivileged local user to gain arbitrary kernel read and write, bypass KASLR, and escalate to root, and in a second attack vector lets an untrusted virtual machine escape into the host's QEMU process. The disclosure was covered by The Hacker News on October 14, 2026, and the lab published its own advisory at Tencent Zhuque Lab. The kernel.org CVE team scores the flaw 8.8 High.

What was the specific vulnerability?

The vulnerability is a memory corruption defect in the vhost subsystem, caused by the composition of two individually reasonable commits spanning nearly a decade of kernel history. According to Tencent Zhuque Lab, the flaw affects kernels from Linux 4.11, released February 28, 2017, through 7.2-rc4. The first commit, f88949138058, added the metadata cache in v4.11; the second, 0210a8db2aec, moved GIOVA validation out of the ioctl into prefetch in v5.9, released October 3, 2020. Together they leave the cache stale when a ring is reconfigured, which is the condition the exploit chain relies on.

The local privilege-escalation path gives an unprivileged user arbitrary kernel read at 8 bytes per read and arbitrary write through an 8-byte vring_used_elem structure containing 2 attacker-chosen bytes and 6 zero bytes. Those two primitives are enough to defeat KASLR and reach root. In the second vector, a virtual machine running behind a virtual IOMMU in device-IOTLB mode can make the host kernel write out of bounds into the host's QEMU process and hijack a function pointer, achieving a virtual machine escape. There is no interim workaround for the guest-to-host escape; the patched kernel is the only remedy for that path, per The Hacker News.

How was the incident detected?

The flaw was found by Corvus AI, a multi-agent system Tencent built for kernel vulnerability research, which the lab says located the bug in 2 hours. "The bug was found with help from Corvus AI, a multi-agent system Tencent built for kernel vulnerability research. The upstream fix credits it with an Assisted-by line, and Tencent says the pipeline found the flaw," The Hacker News reported on October 14, 2026. Tencent Hunyuan's Hy4-preview model was integrated into the subsequent exploit verification and patch validation loop, meaning the same pipeline that surfaced the defect also produced working demonstrations of it.

The disclosure on October 12, 2026 included working demos of both attacks: the local-user-to-root chain and the guest-to-host escape through the virtual IOMMU. The upstream fix carries an Assisted-by line crediting the Corvus AI system, which The Hacker News describes as machine-assisted research rather than an autonomous attack. The same team and pipeline previously disclosed SCTPhantom, an 18-year-old SCTP kernel flaw, in August, which also reached root and in testing escaped a container, indicating the Corvus pipeline has now produced two kernel findings of this class.

What is the current impact?

Any Linux system running kernels 4.11 through 7.2-rc4 with vhost enabled is affected, including servers, cloud hosts, and virtualization platforms on Ubuntu, RHEL, Amazon Linux, Azure Linux, and Oracle Linux. Tencent reproduced the full local-user-to-root chain on five distribution kernels: Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Microsoft Azure Linux 3.0, and Oracle Linux 10.2. On four of the five, the /dev/vhost-net and /dev/vhost-vsock device nodes were world-readable with mode 0666 under the systemd default udev rules; on Ubuntu, access was limited to the kvm group. That device-node permission difference determines whether an ordinary unprivileged user or only a kvm-group member can reach the vulnerable code path on a given distribution.

In virtualized setups with a virtual IOMMU, a guest can escape into the host's QEMU process, which places multi-tenant cloud hosts at risk of guest-to-host compromise on unpatched kernels. The Hacker News notes: "This is machine-assisted research, not an attack run by AI," and "There is no public sign it has been exploited yet." No exploitation in the wild has been reported by either source as of the October 14, 2026 coverage.

What are the next steps?

Operators should update to a fixed stable kernel; the upstream fix is commit de845981da67, which clears the cache whenever the ring is reconfigured. First fixed stable releases include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. According to Tencent Zhuque Lab, Red Hat, Amazon Linux, and Oracle Linux have shipped fixes, while Ubuntu has fixed 22.04 but as of October 13 still lists its 24.04 and 26.04 kernels as in progress. Because the guest-to-host escape has no interim workaround, hosts running untrusted virtual machines behind a virtual IOMMU should prioritize patching. Restricting access to the vhost device nodes is a partial mitigation for the local path only and does not address the escape vector.

By the numbers

Source snapshot