AI-Discovered Linux Kernel Flaw Vghost Allows Local Root and VM Escape
Tencent Zhuque Lab's Corvus AI system found a memory corruption bug in Linux's vhost subsystem that spans nearly a decade of kernels and breaks both the user/root and guest/host boundaries.
A flaw in Linux’s vhost subsystem does something rare even among serious kernel bugs: it gives local users root privileges and can break a guest virtual machine out to the host. The bug, tracked as CVE-2026-74580 and named Vghost by the team that found it, affects kernels from 4.11 to 7.2-rc4.
The reason Vghost reaches in both directions is where it lives. The vhost subsystem is the host kernel’s data path for virtual machine I/O: instead of bouncing every operation between the guest and a userspace process, the kernel itself moves data between a VM’s virtual devices and the host’s hardware. In a Kernel-based Virtual Machine deployment, that direct data path is what makes virtual I/O fast enough to be practical. It also means vhost runs with host-level privileges while parsing data whose layout is controlled by the guest, so a memory corruption bug in that code is reachable from either side of the trust boundary.
Both sides of that trust boundary are exploitable in practice. Tencent Zhuque Lab’s Corvus AI system identified the high-severity memory corruption vulnerability in two hours, and the lab’s writeup describes the bug as spanning nearly a decade of kernel releases with dual exploitation vectors reaching both the host and the guest.
Those vectors are what make the finding more than a local-root bug. From inside a guest, a malicious workload can turn the corruption into a VM escape and land code running on the host; from a local account on the host, the same bug yields a direct escalation to root. Both paths end at the same corrupted memory in the host kernel.
Placed next to each other, the timeline and the discovery time carry most of the story. A memory corruption bug survived nearly a decade in one of the most heavily reviewed codebases in software, and an automated system found it in two hours. That is a concrete demonstration of AI-assisted vulnerability discovery doing something genuinely hard: not triaging known-suspicious code, but finding a deep, exploitable memory corruption bug that human review had missed for years.
The practical takeaway is straightforward. Kernels from 4.11 through 7.2-rc4 are affected, which on long-lived distribution releases means most machines in service carry a bug that crosses both the user/root boundary and the guest/host boundary. The larger question is what the discovery says about the work ahead: if an AI system can surface in two hours a bug that long-lived, the number of similar flaws still sitting in kernel code is an open question, and the argument for pointing more systems like Corvus at that code just got stronger.