Zapscape

The KVM Escape Trilogy ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Zapscape CVE-2026-64561 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape...

Januscape

Januscape: Escape de Invitado a Anfitrión en KVM/x86 Resumen Este documento describe la vulnerabilidad Januscape CVE-2026-53359 descubierta e informada por Hyunwoo Kim @v4bel. Es una vulnerabilidad de escape de KVM que permite que un invitado escape al anfitrión en un entorno KVM/x86. Hasta donde...

CVE-2026-53359-Kernel-Fix

中文 | English 中文 升级 Linux Kernel 7.1.3 修复 CVE-2026-53359 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 验证说明： 经源码比对确认，Linux Kernel 7.1.3 已包含修复 commit 81ccda30b4e8（"KVM: x86: Fix shadow paging use-after-free due to unexpected role"），该补丁在 arch/x86/kvm/mmu/mmu.c 的 kvmmmugetchildsp 函数中增加了 role.word...

SUSE-SU-2026:4259-1 Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for...

Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on devic...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 Kernel Live Patch KVM/x86 English |简体中文 A kernel live patch that fixes CVE-2026-64561 Zapscape on CentOS Stream 8 / RHEL 8 KVM hosts all 4.18.0- kernels. Without the patch : a tenant VM guest can escape to the host with guest-side actions alone and execute code with...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk kvmrmaplock deliberately elides the rmap lock when it observes an empty rmap. In that case kvmrmaplockreadonly also re-enables preemption and returns zero, so...

CVE-2026-89928

CVE-2026-89928 is a slab use-after-free in the Linux kernel's KVM x86/mmu subsystem. The root cause is a race condition in the lockless reverse-mapping (rmap) walk: kvm_rmap_age_gfn_range() ignores the value returned by kvm_rmap_lock_readonly() and instead re-reads the rmap head via rmap_get_firs...

RHEL 8 : kernel (RHSA-2026:68131)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68131 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1 intercepts...

januscape

Januscape — Linux KVM/x86 guest-to-host escape tracking site Source for the Januscape patch-status tracker: a single-page site recording which distributions have shipped a fix for the KVM/x86 guest-to-host escape in the Linux kernel. Where the facts live Everything about the bug — CVE IDs, affect...

OESA-2026-3709 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root after making MMU pages available\n\nCheck for a "stale" page fault, i.e. for an invalid and/or obsolete root, after...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Warns when a triple fault assertion never “escapes” from L2 The warnings are removed because they perform a sanity check that ensures KVM never allows a triple fault in L2 to escape and end up in L1. In normal operation...

Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.67 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-64530: net/sched: clsapi: Handle TCACTCONSUMED ...

MiracleLinux 9 : kernel-5.14.0-687.30.1.el9_8 (AXSA:2026-1781:75)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1781:75 advisory. kernel: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O CVE-2025-40026 kernel: dm log: fix out-of-bounds write due to regioncoun...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053262)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053262 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053218)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053218 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Handle SRCU initialization failure during page track init Check the return of...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053406 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is...

KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page

...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500249)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500249 advisory. - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974835 CVE-2026-80590 - KVM: x86/mmu: Stop needlessly making...