163 matches found
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the...
CVE-2026-53359
CVE-2026-53359 Un error de 16 años en el kernel de Linux permite que una VM alquilada se escape y ataque al host en el que se ejecuta. Januscape es una vulnerabilidad de tipo use-after-free en el código de KVM que ha estado presente desde 2010. Usando el script exploit-check.sh, podemos obtener m...
CVE-2026-53359
🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Guest-to-Host Escape Januscape is a Linux Kernel KVM vulnerability caused by a Use-After-Free UAF condition in the x86 Shadow MMU. Under vulnerable configurations, a malicious guest can corrupt host memory, leading to host crashe...
ROS-20260916-73-0042
The vulnerability of the nestedvmxcheckgueststate function in the arch/x86/kvm/vmx/nested.c module of the Linux KVM virtualization subsystem is related to the lack of checks on registers CR0 and CR1. Exploiting this vulnerability can allow an attacker to cause a failure in the guest operating...
CVE-2026-89727 KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...
The vulnerability of the ioeventfd_in_range() function in the virt/kvm/eventfd.c module of the Kernel-based Virtual Machine (KVM) virtualization subsystem of the Linux operating system allows a attacker to trigger a service failure.
The vulnerability of the ioeventfdinrange function in the virt/kvm/eventfd.c module of the Kernel-based Virtual Machine KVM virtualization subsystem of the Linux operating system is related to an uncontrolled, exploitable condition. Exploitation of this vulnerability could allow a attacker to...
kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nSVM module. When a nested virtual machine L2 guest executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor L1, KVM incorrectly uses vmcb02 instead of vmcb01 for managing guest state...
kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
A flaw was found in the Kernel-based Virtual Machine KVM component of the Linux kernel on ARM64 systems. A highly privileged local attacker could exploit a vulnerability where the system fails to properly restrict memory access during a specific virtual machine operation. This could allow the...
The vulnerability of the `mark_page_dirty_in_slot()` function in the `virt/kvm/kvm_main.c` module of the Kernel-based Virtual Machine (KVM) virtualization subsystem of the Linux operating system allows a malicious actor to trigger a service failure.
The vulnerability of the markpagedirtyinslot function in the virt/kvm/kvmmain.c file of the Kernel-based Virtual Machine KVM subsystem of the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability may allow a remote attacker to cause a service...
The vulnerabilities of the functions __kvm_at_s12() and __kvm_find_s1_desc_level() in the module arch/arm64/kvm/at.c of the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the functions kvmats12 and kvmfinds1desclevel in the arch/arm64/kvm/at.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, an...
The vulnerability of the kvm_reset_dirty_gfn() function in the virt/kvm/dirty_ring.c module of the Kernel-based Virtual Machine (KVM) virtualization subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the kvmresetdirtygfn function in the virt/kvm/dirtyring.c module of the Kernel-based Virtual Machine KVM virtualization subsystem of the Linux operating system is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacke...
The vulnerability of the kvm_vcpu_init_nested() function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the kvmvcpuinitnested function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to...
CVE-2026-80726
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's...
CVE-2026-80726 KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's...
The vulnerability of the __kvm_apic_update_irr() function in the arch/x86/kvm/lapic.c module of the virtualization subsystem on the x86-based Linux kernel allows a hacker to trigger a service failure.
The vulnerability of the kvmapicupdateirr function in the arch/x86/kvm/lapic.c module of the virtualization subsystem on the x86-based Linux kernel is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the invlpga_interception() function in the arch/x86/kvm/svm/svm.c module of the virtualization subsystem on the x86 kernel of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the invlpgainterception function in the arch/x86/kvm/svm/svm.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to error handling deficiencies. Exploiting this vulnerability can allow an attacker to cause a service failure...
Security Bulletin: A Vulnerability of IBM Java SDK affect Linux KVM Agent from IBM Tivoli Monitoring for Virtual Environments
Summary IBM java SDK is used by Linux KVM Agent from IBM Tivoli Monitoring for Virtual Environments. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. CWE:CWE-674:...
CVE-2026-80699
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. This vulnerability, specifically affecting AmpereOne processors, occurs when a physical interrupt is double-deactivated in a nested virtualization context. An attacker could potentially...
CVE-2026-80665
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. The kvmhandlevncrabort function incorrectly assumes that a specific translation result always indicates an abort, even when kvmtranslatevncr returns an error for a Guest Frame Number GFN...
Linux Distros Unpatched Vulnerability : CVE-2026-80684
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails...