Ethical Hacking News
A critical vulnerability has been discovered in Linux's vhost subsystem, allowing local users to gain root access to the system. The Vghost vulnerability affects Linux kernels from 4.11 up to 7.2-rc4 and can be exploited by a local user who can access the vhost device node. The vulnerability can be mitigated by restricting access to the vhost device nodes and patching the Linux kernel.
Linux kernel version 4.11 to 7.2-rc4 are vulnerable to the Vghost security vulnerability. The vulnerability allows local users to gain root access to the system. The vulnerability is caused by a flaw in the vhost subsystem and is a result of a mistake in the code. The vulnerability can be exploited by a local user who can access the vhost device node. Mitigations include restricting access to the vhost device nodes and limiting the owning group to trusted virtualization services. Patching and updating the Linux kernel is crucial to fix the vulnerability.
The Linux kernel has recently faced a critical security vulnerability, known as Vghost, which allows local users to gain root access to the system. This vulnerability was discovered by Tencent Zhuque Lab, a team of researchers who have been actively contributing to the Linux kernel community. The Vghost vulnerability affects Linux kernels from version 4.11 up to 7.2-rc4, making it a significant security concern for users and administrators of these systems.
The Vghost vulnerability is a result of a flaw in the vhost subsystem, which is responsible for speeding up network and other input/output operations for virtual machines and containers. The vulnerability was discovered because of a mistake in the code, which allowed a local user to read and write kernel memory at will, effectively bypassing the kernel address space randomization (KASLR) feature.
The vulnerability works by exploiting a cache-based attack, where the attacker can manipulate the cache of the vhost subsystem to read and write arbitrary kernel memory locations. The cache is cleared when the mapping is updated or invalidated, but not when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands change the ring's addresses or size while the queue is live. This creates a situation where the cache is filled, and subsequent checks never run, allowing the attacker to write to the used ring or read from a descriptor, effectively landing outside the mapped region.
The Vghost vulnerability can be exploited by a local user who can access the vhost device node, usually /dev/vhost-net or /dev/vhost-vsock. The vulnerability can be mitigated by restricting access to the vhost device nodes, removing world access to these nodes, and limiting the owning group to trusted virtualization services.
In addition to the Vghost vulnerability, the article also highlights the severity of the vulnerability and the impact it can have on the system. The vulnerability is rated high, but the raters disagree on how high, with the kernel.org CVE team scoring it 8.8 and marking its scope as changed, because the guest-to-host write reaches memory in the host's QEMU process and crosses the boundary between a guest and its host.
The article also highlights the importance of patching and updating the Linux kernel to fix the vulnerability. The first fixed upstream stable releases are listed, and vendors are advised to backport the fix without changing their version number.
The article concludes by emphasizing the importance of security in the Linux kernel community and the need for continuous testing and research to identify and fix vulnerabilities before they can be exploited by attackers.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Flaw-in-Linuxs-vhost-Subsystem-A-Deep-Dive-into-the-Vghost-Vulnerability-ehn.shtml
https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html
Published: Wed Oct 14 04:36:11 2026 by llama3.2 3B Q4_K_M
