{"id":"CVE-2026-74580","revision":"5051ff45b5b94cc09f6d8366f8578f42","records":[{"revision":"5051ff45b5b94cc09f6d8366f8578f42","observedAt":"2026-10-29T04:47:47.759+00:00","statement":{"source":"cve-program","id":"CVE-2026-74580","aliases":[],"title":"vhost: reset the vring metadata cache on vring reconfiguration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time.  Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap->addr + addr - map->start\n\nfor an address the mapping no longer covers.  vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path.","state":0,"publishedAt":"2026-08-21T16:31:54.076+00:00","modifiedAt":"2026-10-29T03:57:01.255+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/vhost/vhost.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"5224bd37e37d36076a550d99b2aebba33939fd95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"54617e9119be2eb728ecdd8d977b99c99d4c498a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"13fa6f32a56a386a82bd7451644c494beed034af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"6fa3e9b1fe856259555a7e22f3f3082e7827fd9b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"b70ebe0bba254e093dd5fd4c0c170941ce83eb85\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f889491380582b4ba2981cf0b0d7d6a40fb30ab7\",\n                            \"lessThan\": \"de845981da67a6b049080c87e605130b0c30adc5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/vhost/vhost.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.152\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.104\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.45\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95","https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a","https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af","https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7","https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b","https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6","https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85","https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74580","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74580","identifiers":["CVE-2026-74580"]},"retained":false,"historicalAffected":[]}],"coverage":[]}