Summary
CVE-2026-74580: Linux kernel vhost vring metadata cache not reset on VHOST_SET_VRING_ADDR, allowing local privilege escalation.
Affected Asset
Linux kernel vhost / vring subsystem (host kernel). Affects Linux kernel versions with the affected vhost code (before patch 5224bd37e37d).
Affected Endpoint
KVM / vhost module (host kernel)
Prerequisites
Host using Linux kernel with affected vhost module; attacker has ability to reconfigure a vring (e.g., via malicious guest or container that interacts with vhost).
Steps to Reproduce
Reconfigure a vhost vring so the vring metadata cache is not reset (VHOST_SET_VRING_ADDR); then access the stale cached metadata to read arbitrary host memory or trigger use-after-free in the kernel.
Evidence
Kernel stable patches (git.kernel.org/stable): 5224bd37e37d, 54617e9119b, 13fa6f32a56, cf363a7a02, f1e21108e3.
Impact
The stale vhost vring metadata cache can allow a malicious guest to trigger use-after-free or arbitrary host memory access; on a homelab Proxmox host this is local privilege escalation with host-level impact.
Root Cause
Linux kernel vhost module caches vring metadata (vhost_iotlb_map) and fails to reset the cache on vring reconfiguration (VHOST_SET_VRING_ADDR), allowing stale metadata reuse.
Remediation
Apply the kernel patch (commit 5224bd37e37d or newer) that resets the vring metadata cache; upgrade Linux kernel on affected Proxmox/VHOST hosts.
Verification Steps
Check kernel version (uname -r) and confirm the vhost patch (commit 5224bd37e37d or newer) is applied; verify vring reconfiguration no longer skips metadata cache reset by reviewing /sys/kernel/debug or vendor advisory.