Januscape-Hotfix

Januscape Fix Library — CVE-2026-53359 简体中文 Complete fix collection for the CVE-2026-53359 guest-to-host escape vulnerability in the KVM/x86 shadow MMU. From zero-downtime livepatch to kernel upgrade — covers every operational scenario. One-liner Direct curl -sL...

Januscape

Januscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Januscape CVE-2026-53359 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment. To the best of public knowledge, th...

Zapscape

The KVM Escape Trilogy ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Zapscape CVE-2026-64561 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape...

CVE-2026-53359

🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Guest-to-Host Escape Januscape is a Linux Kernel KVM vulnerability caused by a Use-After-Free UAF condition in the x86 Shadow MMU. Under vulnerable configurations, a malicious guest can corrupt host memory, leading to host crashe...

KVM-Januscape

KVM memory hot-patching tool for the KVM shadow MMU issue involving CVE-2026-53359, which modifies kernel instructions at runtime and includes an ELF offset analysis script. This project directly modifies kernel instructions in memory and should only be used on systems you own and are authorized ...

slides

slides A collection of slides. 2025 A tale of challenging MTE: Rooting Google Pixel with kernel MTE enabled in one shot Conference: POC 2025 2024 Simple bug but not easy exploit: Rooting Android devices in one shot Conference: Cansecwest 2024 Almost same with POC 2023, except for MTE 2023 Simple...

CVE-2026-64561

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, guest escape to host root HackSpeak distribution mirror. This repository is a distribution mirror of the complete PoC + technical write-up publicly released by researcher Hyunwoo Kim @v4bel , with code and documentation identical to upstream. ⚠️...

Linux Distros Unpatched Vulnerability : CVE-2026-90586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in...

UBUNTU-CVE-2026-90586

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586 Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

EUVD-2026-120487

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586

The Zephyr RTOS Xtensa MMU userspace port is vulnerable to an uninitialized pointer issue because the thread->arch.ptables pointer is not initialized during thread setup. The function arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c treats a non-NULL value in this field as a predicat...

CVE-2026-90586 Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-90586: zephyrproject zephyr: The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread…

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

PT-2026-141162

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while arch mem domain thread add in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. These pointers live in kvm.ko; thus, they survive when a vendor modul...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can...

CVE-2026-19199

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or...

EUVD-2026-113488

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or...