CVE-2026-74580

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vhost: reset the vring metadata cache on vring reconfiguration<br /> <br /> vq-&gt;meta_iotlb[] caches the vhost_iotlb_map that backs each vring<br /> metadata region, and iotlb_access_ok() returns early on a cache hit,<br /> taking the hit as proof that the region has already been validated:<br /> <br /> if (vhost_vq_meta_fetch(vq, addr, len, type))<br /> return true;<br /> <br /> The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on<br /> device IOTLB (re)initialisation and on vq reset, but not when<br /> VHOST_SET_VRING_ADDR replaces vq-&gt;desc, vq-&gt;avail and vq-&gt;used, nor when<br /> VHOST_SET_VRING_NUM changes the region sizes.<br /> <br /> With a device IOTLB attached both ioctls are accepted while the vq is<br /> live, and neither validates the addresses at ioctl time: vq_access_ok()<br /> and vq_log_used_access_ok() return true early because the addresses are<br /> GIOVAs, deferring validation to prefetch time. Once the cache has been<br /> populated that deferred validation no longer runs -- vq_meta_prefetch()<br /> hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps<br /> translating through the old mapping as<br /> <br /> map-&gt;addr + addr - map-&gt;start<br /> <br /> for an address the mapping no longer covers. vhost_copy_to_user() and<br /> vhost_copy_from_user() consume the result with __copy_to_user() and<br /> __copy_from_user(), which do not check it either, so a subsequent used<br /> ring update or descriptor fetch accesses memory outside the region the<br /> IOTLB actually maps.<br /> <br /> Reset the metadata cache whenever the vring is reconfigured, so the new<br /> addresses are pushed back through iotlb_access_ok()&amp;#39;s slow path.