Linux kernel vhost stale IOTLB metadata cache leading to LPE and VM escape (Vghost)

#!/usr/bin/env bash
# check_vghost.sh — CVE-2026-74580 (Vghost) local detection
# Checks running kernel version and vhost device permissions.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch from kernel version string
parse_version() {
  local ver="$1"
  # Strip everything after first hyphen for comparison
  local base="${ver%%-*}"
  local major minor patch
  IFS='.' read -r major minor patch <<< "$base"
  patch=${patch%%[^0-9]*}  # strip trailing non-numeric
  echo "$major $minor ${patch:-0}"
}

version_gte() {
  local a1 a2 a3 b1 b2 b3
  read -r a1 a2 a3 <<< "$(parse_version "$1")"
  read -r b1 b2 b3 <<< "$(parse_version "$2")"
  if (( a1 > b1 )); then return 0; fi
  if (( a1 < b1 )); then return 1; fi
  if (( a2 > b2 )); then return 0; fi
  if (( a2 < b2 )); then return 1; fi
  if (( a3 >= b3 )); then return 0; fi
  return 1
}

VULNERABLE=0
PATCHED=0

read -r MAJOR MINOR PATCH <<< "$(parse_version "$KERNEL")"

# Check against fixed stable branches
if (( MAJOR < 4 )) || { (( MAJOR == 4 )) && (( MINOR < 11 )); }; then
  echo "[+] Kernel predates vulnerable code (introduced in 4.11). PATCHED"
  PATCHED=1
elif (( MAJOR == 5 && MINOR == 10 )); then
  if version_gte "$KERNEL" "5.10.265"; then
    echo "[+] Fixed in 5.10.265; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 5.10.x < 5.10.265"; VULNERABLE=1
  fi
elif (( MAJOR == 5 && MINOR == 15 )); then
  if version_gte "$KERNEL" "5.15.216"; then
    echo "[+] Fixed in 5.15.216; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 5.15.x < 5.15.216"; VULNERABLE=1
  fi
elif (( MAJOR == 6 && MINOR == 1 )); then
  if version_gte "$KERNEL" "6.1.183"; then
    echo "[+] Fixed in 6.1.183; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 6.1.x < 6.1.183"; VULNERABLE=1
  fi
elif (( MAJOR == 6 && MINOR == 6 )); then
  if version_gte "$KERNEL" "6.6.152"; then
    echo "[+] Fixed in 6.6.152; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 6.6.x < 6.6.152"; VULNERABLE=1
  fi
elif (( MAJOR == 6 && MINOR == 12 )); then
  if version_gte "$KERNEL" "6.12.104"; then
    echo "[+] Fixed in 6.12.104; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 6.12.x < 6.12.104"; VULNERABLE=1
  fi
elif (( MAJOR == 6 && MINOR == 18 )); then
  if version_gte "$KERNEL" "6.18.45"; then
    echo "[+] Fixed in 6.18.45; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 6.18.x < 6.18.45"; VULNERABLE=1
  fi
elif (( MAJOR == 7 && MINOR == 1 )); then
  if version_gte "$KERNEL" "7.1.9"; then
    echo "[+] Fixed in 7.1.9; running $KERNEL. PATCHED"; PATCHED=1
  else
    echo "[-] Vulnerable: 7.1.x < 7.1.9"; VULNERABLE=1
  fi
elif (( MAJOR == 7 && MINOR >= 2 )); then
  echo "[+] Kernel 7.2+ includes the fix. PATCHED"; PATCHED=1
elif (( MAJOR >= 4 && MAJOR <= 7 )); then
  # Non-stable branches between 4.11 and 7.1 without explicit fix tracking
  echo "[?] Kernel $KERNEL is in the vulnerable range (4.11-7.2) but not a tracked stable branch."
  echo "    Check if your distro has backported commit de845981da67."
fi

# Check vhost device permissions
echo ""
echo "[*] Checking vhost device exposure:"
EXPOSED=0
for dev in /dev/vhost-net /dev/vhost-vsock /dev/vhost-scsi; do
  if [ -e "$dev" ]; then
    PERMS=$(stat -c '%a' "$dev" 2>/dev/null || stat -f '%Lp' "$dev" 2>/dev/null)
    OWNER=$(stat -c '%U:%G' "$dev" 2>/dev/null || stat -f '%Su:%Sg' "$dev" 2>/dev/null)
    echo "    $dev  mode=$PERMS  owner=$OWNER"
    if [[ "$PERMS" == *"666"* ]] || [[ "$PERMS" == *"662"* ]]; then
      echo "    WARNING: $dev is world-writable — any local user can exploit CVE-2026-74580"
      EXPOSED=1
    fi
  else
    echo "    $dev  not present"
  fi
done

# Check if vhost modules are loaded
echo ""
echo "[*] Checking vhost module status:"
if lsmod 2>/dev/null | grep -q vhost; then
  lsmod | grep vhost | while read -r mod rest; do
    echo "    Module loaded: $mod"
  done
else
  echo "    No vhost modules currently loaded"
fi

echo ""
if (( PATCHED == 1 )); then
  echo "RESULT: PATCHED"
  exit 0
elif (( VULNERABLE == 1 )); then
  if (( EXPOSED == 1 )); then
    echo "RESULT: VULNERABLE (world-accessible vhost devices — CRITICAL exposure)"
  else
    echo "RESULT: VULNERABLE"
  fi
  exit 1
else
  echo "RESULT: UNKNOWN — verify commit de845981da67 is present in your kernel source"
  exit 2
fi