AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

A flaw in Linux's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it allows an untrusted virtual machine to write to the host's memory and hijack the program running the VM. Tencent Zhuque Lab found the bug.