slides

diapositivas Una colección de diapositivas. 2025 Una historia sobre cómo desafiar a MTE: Rootear Google Pixel con el MTE del kernel habilitado en un solo intento Conferencia: POC 2025 2024 Un bug simple pero no fácil de explotar: Rootear dispositivos Android de una sola vez Conferencia: Cansecwes...

CVE-2026-98164

The Linux kernel contains a vulnerability in the KVM x86/mmu component. The function kvm_gfn_is_write_tracked() incorrectly checks only the supplied memslot, whereas page tracking is per-address-space and shadow pages are shared across all spaces. In an SMM context, a GFN can be write-tracked in ...

EUVD-2026-88753

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can...

Zapscape

La trilogía de escapes de KVM ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Escape de invitado a host en KVM/x86 Resumen Este documento describe la vulnerabilidad Zapscape CVE-2026-64561 , descubierta e informada por Hyunwoo Kim @v4bel. Es una...

Januscape

Januscape：KVM/x86 环境中的客户机到宿主机逃逸 摘要 本文档描述了由 Hyunwoo Kim @v4bel 发现并报告的 Januscape CVE-2026-53359 漏洞。这是一个 KVM 逃逸漏洞，可使客户机在 KVM/x86 环境中逃逸至宿主机。据公开所知，这是首个可在 Intel 和 AMD 上触发而不仅限于单一架构的客户机到宿主机利用研究。 Januscape 是 KVM/x86 的 shadow MMU 模拟中的一个释放后使用漏洞。仅通过客户机侧操作即可触发该漏洞，破坏宿主机内核的影子页，并可能威胁那些接受不可信客户机并暴露嵌套虚拟化的 KVM/x86...

KVM-Januscape

KVM-XJ 热补丁 dumptool.py 是自动寻找偏移，怎么用就自己看代码 漏洞概述 CVE-2026-53359（Januscape）是 Linux 内核 KVM 影子 MMU 中的释放后使用（UAF）漏洞。 潜伏时间：16 年（2010年8月至2026年7月） 影响范围：所有启用嵌套虚拟化的 Intel/AMD x86 系统 危害等级：高危，VM 内 root 用户可逃逸到母鸡，获取母鸡 root 权限 利用方式：母鸡内核 panic（DoS）或完整虚拟机逃逸（无公开POC） 漏洞原理 kvmmmugetpage 函数在哈希表中查找可复用的影子页表时，仅比较了...

CVE-2026-53359

🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Guest-to-Host Escape Januscape is a Linux Kernel KVM vulnerability caused by a Use-After-Free UAF condition in the x86 Shadow MMU. Under vulnerable configurations, a malicious guest can corrupt host memory, leading to host crashe...

CVE-2026-64561

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, escape del guest al host root HackSpeak 分发镜像。本仓库为研究员 Hyunwoo Kim@v4bel公开的完整 PoC + 技术文档的分发镜像 ,代码与文档与上游一致。 ⚠️ 上游未附 LICENSE :镜像按分发惯例采用 MIT License,Copyright c 2026 HackSpeak ,源码版权归原代码作者 V4bel / @v4bel。PoC 未经真机验证 ,请先在可销毁环境QEMU TCG测试,勿对未授权目标使用。 Resumen...

Januscape-Hotfix

Repositorio de soluciones para Januscape — CVE-2026-53359 English Colección completa de soluciones para la vulnerabilidad de escape de máquina virtual KVM/x86 shadow MMU CVE-2026-53359. Desde parches en caliente sin tiempo de inactividad hasta actualizaciones del kernel, cubriendo todos los...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928

CVE-2026-89928 is a slab use-after-free in the Linux kernel's KVM x86/mmu subsystem. The root cause is a race condition in the lockless reverse-mapping (rmap) walk: kvm_rmap_age_gfn_range() ignores the value returned by kvm_rmap_lock_readonly() and instead re-reads the rmap head via rmap_get_firs...

EUVD-2026-80296

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89928: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89916: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

OESA-2026-3709 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root after making MMU pages available\n\nCheck for a "stale" page fault, i.e. for an invalid and/or obsolete root, after...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: Avoid unnecessary calls to invalidrangestart/invalidaterangeend when using mremap with oldsize=0. If the mremap system call with oldsize=0 ends up in movepagetables, it will unnecessarily call...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fixed the error path in panfrostmmumapfaultaddr Subject: PATCH drm/panfrost: Fixed the error path in panfrostmmumapfaultaddr If some of the page allocations fail, we should not release the previous references to tho...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Immediately reset the MMU context when the SMM flag is cleared The MMU context should be reset immediately when the SMM flag of the vCPU is cleared, so that the SMM flag in the MMU context is always synchronized with th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: IB/hfi1: Fixed bugs related to non-PAGESIZE-end multi-iovec user SDMA requests. The processing of hfi1 user SDMA requests contains two bugs that can cause data corruption for user SDMA requests with multiple payload iovecs. In...