{"id":"CVE-2026-74580","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-74580","summary":"vhost: reset the vring metadata cache on vring reconfiguration","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time.  Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap->addr + addr - map->start\n\nfor an address the mapping no longer covers.  vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path.","published":"2026-08-21T16:31:54.076Z","modified":"2026-08-23T03:53:40.082562763Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"5.10.265"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74580.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74580"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-23T03:53:40.082562763Z"}}