vq->meta_iotlb[] caches the IOTLB mapping behind each vring metadata region ( desc / avail / used ). VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM do not reset that cache. With a device IOTLB attached, a live vq can translate a reconfigured vring through a mapping that no longer covers it. vhost_vq_meta_fetch() has no range check, and the result is passed to __copy_to_user() / __copy_from_user() .
The same stale cache is reachable from a guest when vhost runs in device-IOTLB mode ( VIRTIO_F_ACCESS_PLATFORM / vIOMMU) and the guest resets a virtqueue via VIRTIO_F_RING_RESET . That path is not this PoC.
CVE: CVE-2026-74580 (CVSS 8.8)
poc.c is a harmless host x86-64 PoC against /dev/vhost-vsock . It writes a dummy path to modprobe_path , confirms it, restores the original, and stops. No payload, no root shell.
Symbol lookup uses, in order: $SYSTEM_MAP , /boot/System.map-$(uname -r) , /usr/lib/modules/$(uname -r)/build/System.map . modprobe_path must be present; asm_exc_divide_error falls back to a static address if missing.
The process must be able to open /dev/vhost-vsock . Some images ship that node 0666 ; others are 0660 root:kvm .
Run only on a disposable test system you own.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
