# CVE-2026-74580 (Vghost) mitigation: remove world access to vhost device nodes.
# Remove once every host runs a fixed kernel (upstream fix de845981da67).
KERNEL=="vhost-net",    GROUP="kvm", MODE="0660", OPTIONS+="static_node=vhost-net"
KERNEL=="vhost-vsock",  GROUP="kvm", MODE="0660", OPTIONS+="static_node=vhost-vsock"
KERNEL=="vhost-scsi",   GROUP="kvm", MODE="0660"
KERNEL=="vhost-vdpa-*", GROUP="kvm", MODE="0660"