一、漏洞信息
漏洞编号：CVE-2026-74580
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.12.33,6.18.18,6.18.40,6.4.0,6.6.0
CVSS评分：
BaseScore：8.8 High
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:vhost: reset the vring metadata cache on vring reconfigurationvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vringmetadata region, and iotlb_access_ok() returns early on a cache hit,taking the hit as proof that the region has already been validated: if (vhost_vq_meta_fetch(vq, addr, len, type)) return true;The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, ondevice IOTLB (re)initialisation and on vq reset, but not whenVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor whenVHOST_SET_VRING_NUM changes the region sizes.With a device IOTLB attached both ioctls are accepted while the vq islive, and neither validates the addresses at ioctl time: vq_access_ok()and vq_log_used_access_ok() return true early because the addresses areGIOVAs, deferring validation to prefetch time. Once the cache has beenpopulated that deferred validation no longer runs -- vq_meta_prefetch()hits the stale entry and returns true -- and vhost_vq_meta_fetch() keepstranslating through the old mapping as map->addr + addr - map->startfor an address the mapping no longer covers. vhost_copy_to_user() andvhost_copy_from_user() consume the result with __copy_to_user() and__copy_from_user(), which do not check it either, so a subsequent usedring update or descriptor fetch accesses memory outside the region theIOTLB actually maps.Reset the metadata cache whenever the vring is reconfigured, so the newaddresses are pushed back through iotlb_access_ok() s slow path.
漏洞公开时间：2026-08-22 01:16:44
漏洞创建时间：2026-08-22 02:07:32
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-74580

漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:vhost: reset the vring metadata cache on vring reconfigurationvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vringmetadata region, and iotlb_access_ok() returns early on a cache hit,taking the hit as proof that the region has already been validated:if (vhost_vq_meta_fetch(vq, addr, len, type))return true;The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, ondevice IOTLB (re)initialisation and on vq reset, but not whenVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor whenVHOST_SET_VRING_NUM changes the region sizes.With a device IOTLB attached both ioctls are accepted while the vq islive, and neither validates the addresses at ioctl time: vq_access_ok()and vq_log_used_access_ok() return true early because the addresses areGIOVAs, deferring validation to prefetch time. Once the cache has beenpopulated that deferred validation no longer runs -- vq_meta_prefetch()hits the stale entry and returns true -- and vhost_vq_meta_fetch() keepstranslating through the old mapping asmap->addr + addr - map->startfor an address the mapping no longer covers. vhost_copy_to_user() andvhost_copy_from_user() consume the result with __copy_to_user() and__copy_from_user(), which do not check it either, so a subsequent usedring update or descriptor fetch accesses memory outside the region theIOTLB actually maps.Reset the metadata cache whenever the vring is reconfigured, so the newaddresses are pushed back through iotlb_access_ok() s slow path.
openEuler评分：
8.8
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
受影响版本排查(受影响/不受影响)：
1.master(6.18.40):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS-Next(6.6.0):不受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP3(6.6.0):受影响
7.openEuler-24.03-LTS-SP4(6.6.0):受影响
8.openEuler-22.03-LTS-SP3(5.10.0):受影响
9.openEuler-24.03-LTS(6.6.0):受影响
10.openEuler-24.03-LTS-SP2(6.6.0):受影响

修复是否涉及abi变化(是/否)：
1.master(6.18.40):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP4(5.10.0):否
4.openEuler-24.03-LTS-Next(6.6.0):否
5.openEuler-24.03-LTS-SP1(6.6.0):否
6.openEuler-24.03-LTS-SP3(6.6.0):否
7.openEuler-24.03-LTS-SP4(6.6.0):否
8.openEuler-22.03-LTS-SP3(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
1.master(6.18.40):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):漏洞仍在分析中
3.openEuler-22.03-LTS-SP4(5.10.0):正常修复
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-24.03-LTS-SP3(6.6.0):正常修复
7.openEuler-24.03-LTS-SP4(6.6.0):正常修复
8.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
9.openEuler-24.03-LTS(6.6.0):不修复-超出修复范围
10.openEuler-24.03-LTS-SP2(6.6.0):不修复-超出修复范围