{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-16T00:25:01.162","vulnerabilities":[{"cve":{"id":"CVE-2026-74580","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-21T17:16:44.210","lastModified":"2026-10-15T19:10:00.173","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time.  Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap->addr + addr - map->start\n\nfor an address the mapping no longer covers.  vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvhost: restablecer la caché de metadatos del vring en la reconfiguración del vring\n\nvq -> meta_iotlb[] almacena en caché el vhost_iotlb_map que respalda cada región de metadatos del vring, y iotlb_access_ok() retorna temprano en un acierto de caché, tomando el acierto como prueba de que la región ya ha sido validada:\n\nif (vhost_vq_meta_fetch(vq, addr, len, type))\n\treturn true;\n\nLa caché se restablece en VHOST_IOTLB_UPDATE y VHOST_IOTLB_INVALIDATE, en la (re)inicialización del IOTLB del dispositivo y en el restablecimiento del vq, pero no cuando VHOST_SET_VRING_ADDR reemplaza vq -> desc, vq -> avail y vq -> used, ni cuando VHOST_SET_VRING_NUM cambia los tamaños de las regiones.\n\nCon un IOTLB de dispositivo adjunto, ambos ioctls son aceptados mientras el vq está activo, y ninguno valida las direcciones en el momento del ioctl: vq_access_ok() y vq_log_used_access_ok() retornan true temprano porque las direcciones son GIOVAs, aplazando la validación al momento de la precarga. Una vez que la caché ha sido poblada, esa validación aplazada ya no se ejecuta -- vq_meta_prefetch() acierta la entrada obsoleta y retorna true -- y vhost_vq_meta_fetch() sigue traduciendo a través del mapeo antiguo como\n\nmap -> addr + addr - map -> start\n\npara una dirección que el mapeo ya no cubre. vhost_copy_to_user() y vhost_copy_from_user() consumen el resultado con __copy_to_user() y __copy_from_user(), que tampoco lo verifican, por lo que una actualización posterior del anillo usado o una obtención de descriptor accede a memoria fuera de la región que el IOTLB realmente mapea.\n\nRestablecer la caché de metadatos cada vez que el vring es reconfigurado, para que las nuevas direcciones sean empujadas de vuelta a través de la ruta lenta de iotlb_access_ok()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/vhost.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"5224bd37e37d36076a550d99b2aebba33939fd95","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"54617e9119be2eb728ecdd8d977b99c99d4c498a","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"13fa6f32a56a386a82bd7451644c494beed034af","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"6fa3e9b1fe856259555a7e22f3f3082e7827fd9b","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"b70ebe0bba254e093dd5fd4c0c170941ce83eb85","versionType":"git","status":"affected"},{"version":"f889491380582b4ba2981cf0b0d7d6a40fb30ab7","lessThan":"de845981da67a6b049080c87e605130b0c30adc5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/vhost.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/14/2","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}