vhost is the Linux kernel backend that accelerates some virtio devices. Instead of handling every device operation in userspace, vhost moves part of the work into the kernel so virtual networking and storage can run faster. Common implementations are exposed through device nodes such as /dev/vhost-net, which makes vhost a privileged bridge between a guest VM and host resources.
This matters for security because performance shortcuts also create high-value trust boundaries. vhost maintains cached state, including translation and ring-buffer metadata, so bugs in validation or state reset can let stale mappings be reused after the device layout changes. In attacks, that can turn a local device interface into kernel read/write access, or in some virtualization configurations let a guest influence host memory and the process running the VM. Defensively, vhost should be treated as sensitive kernel attack surface: keep kernels patched, apply vendor backports, and restrict access to vhost device nodes and advanced virtualization features that widen the blast radius.