AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

A flaw in the Linux kernel’s vhost subsystem, tracked as CVE-2026-74580 and named Vghost, lets a local user read and write kernel memory and gain root across nearly a decade of kernel versions. In one virtualization setup it also lets an untrusted guest virtual machine write to host memory and hijack the program running the VM, according to Tencent Zhuque Lab, which found the bug.