CVE-2026-89930

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nested virtualization nVMX component. KVM fails to perform necessary Translation Lookaside Buffer TLB flushes when a nested virtual machine VM entry operation fails. This can lead to an outdated TLB state, potentially allowin...

Januscape

Januscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Januscape CVE-2026-53359 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment. To the best of public knowledge, th...

Zapscape

The KVM Escape Trilogy ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Zapscape CVE-2026-64561 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape...

hyperv_local_dos_poc

Hyper-V DoS PoC. This is code files of Visual Studio 2019 driver project. 1. Compile driver. 2. Enable nested virtualization for guest OS using command: Set-VMProcessor -VMName -ExposeVirtualizationExtensions $true 3. Run driver inside guest OS. Host OS will be rebooted or generate BSOD with...

CVE-2021-3656-Demo

CVE-2021-3656: This issue is caused by missing validation of the the virtext VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS Virtual VMLOAD/VMSAVE for the L2 guest. Under these circumstances, the L2 guest is able to run VMLOAD/VMSAVE unintercepted, and...

CVE-2026-68081

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel, specifically within its nested virtualization nVMX feature. When a nested virtual machine VM attempts to enter an invalid guest state during VMLAUNCH or VMRESUME operations, the system fails to properly releas...

KVM-Januscape

KVM-XJ Hot Patch dumptool.py automatically finds offsets; how to use it? Just read the code. Vulnerability Overview CVE-2026-53359 Januscape is a use-after-free UAF vulnerability in the Linux kernel KVM shadow MMU. Lurking time : 16 years August 2010 to July 2026 Affected range : All Intel/AMD x8...

CVE-2026-64561

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, guest escape to host root HackSpeak distribution mirror. This repository is a distribution mirror of the complete PoC + technical write-up publicly released by researcher Hyunwoo Kim @v4bel , with code and documentation identical to upstream. ⚠️...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove the user-triggered WARN message emitted by nestedsvmloadcr3. Remove the WARN message generated by svmsetnestedstate in nestedsvmloadcr3 failure cases. This message can be easily triggered from userspace by...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Forcibly leave nested virtualization mode when SMM state is toggled The nested virtualization mode is forcibly exited if the user space toggles the SMM state using KVMSETVCPUEVENTS or KVMSYNCX86EVENTS. If the user space...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory Ignore nCR34:0 when loading PDPTEs from memory for nested SVMs. When PAE paging is used, the bits 4:0 of the CR3 register are ignored, and thus VMRUN does not enforce a...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc (crlsa-2021_3548)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213548 advisory. kernel: SVM nested virtualization issue in KVM AVIC support CVE-2021-3653 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2021_3547)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213547 advisory. kernel: SVM nested virtualization issue in KVM AVIC support CVE-2021-3653 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2021_4056)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214056 advisory. kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free CVE-2020-36385 kernel: out-of-bounds write due to a heap buffer overflow in...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786761805)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786761805 advisory. - A flaw was found in the KVM's AMD nested virtualization SVM. A malicious L1 guest could purposely fail to intercept the shutdown ...

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the...

SUSE CVE-2026-89929

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...