CVE-2026-74580 (V-GHOST) – Affected Proxmox VE Versions

S

shahin352

Member
Aug 21, 2023
10
0
6
Hello,

Regarding the recently disclosed vulnerability CVE-2026-74580 (V-GHOST):

https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580

Could you please clarify:

  • Which Proxmox VE versions (PVE 8 and PVE 9) are affected?
  • Under what conditions can privilege escalation or VM escape occur?
  • What are the minimum fixed kernel versions for each PVE release?
  • Are any temporary mitigations recommended?
Thank you for your clarification.
 
hi,

this should be fixed (since a while) at least in 7.0.14-14

exceprt from 'apt changelog proxmox-kernel-7.0'

proxmox-kernel-7.0 (7.0.14-14) trixie; urgency=medium

* update ZFS to 2.4.4.

* cherry-pick fixes for relevant CVEs announced since 18.08.2026:
- CVE-2026-74579: too broad match mask when offloading nftables rules
that match only part of a header field
- CVE-2026-74581: use-after-free of a route suppressed by an IPv6
routing rule
- CVE-2026-74580: out-of-bounds host memory access through a stale vhost
IOTLB metadata cache after a vring was reconfigured
- CVE-2026-74582: out-of-bounds write in the AF_PACKET send path when a
device changes its link-layer header length concurrently
- CVE-2026-74583: use-after-free in the route4 traffic classifier

-- Proxmox Support Team <support@proxmox.com> Sat, 22 Aug 2026 17:01:19 +0200
Click to expand...
 
  • Like
Reactions: shahin352 and jsterr
Thanks
Under what conditions is CVE-2026-74580 exploitable, and are there any recommended temporary mitigations for Proxmox VE 8 ?
 
You must log in or register to reply here.
Top Bottom
Back