Zapscape

KVM 逃逸三部曲 ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape：KVM/x86 中的客户机到宿主机逃逸 摘要 本文档描述了由 Hyunwoo Kim @v4bel 发现并报告的 Zapscape CVE-2026-64561 漏洞。这是一个 KVM 逃逸漏洞，允许客户机在 KVM/x86 环境中逃逸到宿主机，并以内核（root）权限在宿主机上执行命令。 Zapscape 是 KVM/x86 的影子 MMU（shadow...

Januscape

Januscape: KVM/x86におけるゲストからホストへの脱出 概要 このドキュメントは、Hyunwoo Kim @v4bel によって発見・報告された Januscape CVE-2026-53359 脆弱性について説明します。これはKVM/x86環境においてゲストからホストへの脱出を可能にするKVMエスケープ脆弱性です。公に知られている限り、これはIntelとAMDの両方でトリガー可能な初のゲスト-to-ホストエクスプロイト研究であり、単一アーキテクチャに限定されません。 JanuscapeはKVM/x86のシャドウMMU...

CVE-2026-53359-Kernel-Fix

中文 | 英語 中文 升级 Linux Kernel 7.1.3 修复 CVE-2026-53359 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 验证说明： 经源码比对确认，Linux Kernel 7.1.3 已包含修复 commit 81ccda30b4e8（"KVM: x86: Fix shadow paging use-after-free due to unexpected role"），该补丁在 arch/x86/kvm/mmu/mmu.c 的 kvmmmugetchildsp 函数中增加了 role.word...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 KVM 内核热补丁 English | 简体中文 给 CentOS Stream 8 / RHEL 8 （4.18.0 全系列内核）的 KVM 宿主机修复 CVE-2026-64561（Zapscape） 漏洞的内核热补丁 ： 不打补丁的风险 ：租户虚拟机（guest）可以仅凭自身操作逃逸到宿主机，以宿主 内核 root 权限执行代码——击穿整台物理机及其上所有虚拟机。 本项目的补丁 ：基于 Linux 上游官方修复（2abd5287f083）backport 而来， 通过内核 livepatch 机制在线生效 ： ✅ 不重启宿...

januscape

Januscape — Linux KVM/x86 客户机到宿主机逃逸跟踪站点 Januscape 补丁状态跟踪器的源码：一个单页站点，记录哪些发行版已为 Linux 内核中的 KVM/x86 客户机到宿主机逃逸发布了修复。 事实存放位置 关于该漏洞的所有信息——CVE ID、受影响版本与已修复版本、上游修复提交、发现与披露致谢，以及各发行版当前的补丁状态——均属于跟踪页面，而非本 README： 渲染页面： https://kimmo.cloud/januscape/ 源文件： site/content/index.md 编辑该文件即可；本仓库中的其他一切皆为构建基础设施。...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_36957)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636957 advisory. kernel: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange CVE-2025-71066 kernel: KVM: x86: Fix shadow paging...

SUSE SLES15 Security Update : kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4383-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4383-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues: The following security issues were fixed: -...

SUSE-SU-2026:23968-1 Security update for the Linux Kernel (Live Patch 15 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolet...

Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-64561: KVM: x86: Check for invalid/obsolete ro...

SUSE-SU-2026:4383-1 Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolet...

Security update for the Linux Kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.177 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-64561: KVM: x86: Check for invalid/obsolete...

Security update for the Linux Kernel (Live Patch 29 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.125 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-64561: KVM: x86: Check for invalid/obsolete...

SUSE-SU-2026:4259-1 Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for...

Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on devic...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928

CVE-2026-89928 is a slab use-after-free in the Linux kernel's KVM x86/mmu subsystem. The root cause is a race condition in the lockless reverse-mapping (rmap) walk: kvm_rmap_age_gfn_range() ignores the value returned by kvm_rmap_lock_readonly() and instead re-reads the rmap head via rmap_get_firs...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

RHEL 8 : kernel (RHSA-2026:68131)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68131 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1 intercepts...

SUSE-SU-2026:23763-1 Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root...

SUSE-SU-2026:23835-1 Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device...