CVE-2026-80684

A flaw was found in the KVM Kernel-based Virtual Machine subsystem for s390 PCI devices in the Linux kernel. This vulnerability occurs when the airqivcreate function fails to allocate a resource, returning a NULL value that is not properly checked. An attacker, potentially a malicious guest user,...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC ヒープ領域外アクセス KVMのSEV-SNP Page State Change（PSC）処理におけるヒープ領域外読み取りおよび書き込みの概念実証です。悪意のあるSEV-SNPゲストがホストカーネルにPSCエントリ配列をスラブ割り当ての末尾まで走査させます。これにより、隣接する kmalloc-cg-32 オブジェクトのレイアウトが漏洩し、制御された小さな値がそれらに書き込まれます。ゲストはこれを好きなだけ繰り返すことができます。 Full writeup:...

CVE-2026-53359

🚨 CVE-2026-53359 — Januscape Linux KVM Shadow Paging Use-After-Free Escape de Invitado a Anfitrión Januscape es una vulnerabilidad del Kernel de Linux KVM causada por una condición de Use-After-Free UAF en la x86 Shadow MMU. Bajo configuraciones vulnerables, un invitado malicioso puede corromper ...

KVM-Januscape

KVM-XJ ホットパッチ dumptool.py はオフセットを自動検索するためのものです。使い方はコードを見てください。 脆弱性概要 CVE-2026-53359（Januscape）は、Linux カーネル KVM シャドウ MMU における Use-After-Free（UAF）脆弱性です。 潜伏期間：16 年（2010年8月～2026年7月） 影響範囲：ネステッド仮想化を有効にしたすべての Intel/AMD x86 システム 危険度：高、VM 内の root ユーザーがホストに脱出し、ホストの root 権限を取得可能...

CVE-2026-53359

CVE-2026-53359 Linuxカーネルに存在する16年前のバグにより、レンタルしたVMが脱出して、自身が稼働するホストを攻撃できるようになります。 Januscape は、KVM コードに2010年から存在する use-after-free 脆弱性です。 exploit-check.sh スクリプトを使用すると、Linuxカーネルの脆弱性 CVE-2026-53359 に関するより詳細な脆弱性情報を取得できます。 root@kitploit: wget...

Linux Distros Unpatched Vulnerability : CVE-2026-80665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns...

UBUNTU-CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

SUSE SLES11: kernel-default / kernel-default-base / kernel-ec2 / kernel-ec2-base / etc (SUSE-SU-2026:3809-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3809-1 advisory. The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-53995:...

UBUNTU-CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

UBUNTU-CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2110)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2110 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock CVE-2026-45897 In the Linux kernel, the following vulnerability has bee...

Linux Distros Unpatched Vulnerability : CVE-2026-80699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW...

itscape

ITScape — Linux KVM/arm64 ゲストからホストへのエスケープ追跡サイト ITScape パッチステータストラッカーのソースです。Linux カーネルの KVM/arm64 ゲストからホストへのエスケープに対する修正を、どのディストリビューションがリリースしたかを記録するシングルページサイトです。 事実はどこにあるか バグに関するすべての情報（CVE ID、影響を受けるバージョンと修正済みバージョン、上流の修正コミット、発見と開示のクレジット、ディストリビューションごとの最終的なパッチステータス）は、この README ではなくトラッカーページにあります。 表示:...

Zapscape

⚡ Zapscape - Your Computer's Safety Net, Simplified ⬇️ DOWNLOAD ZAPSCAPE NOW 🛡️ What Is Zapscape? Zapscape is a friendly tool that helps protect your computer from a hidden threat called a "KVM escape." Think of it as a digital shield that keeps your personal files, photos, and information safe...

CVE-2024-56426

Exynos 990 / Exynos9830 Unified BootROM Exploit Unified CVE-2024-56426 tooling for the Exynos 990 Galaxy S20, S20 FE, and Note20 families. The exploit accepts all ten model names and maps them onto six verified stock bootloader families. !CAUTION The tracked key bundle and generated images are...

CVE-2026-64561

CVE-2026-64561 — Zapscape:KVM/x86 shadow MMU UAF, escape do guest para o host root Imagem de distribuição HackSpeak. Este repositório é um espelho de distribuição do PoC completo + documentação técnica divulgados pelo pesquisador Hyunwoo Kim @v4bel , com código e documentação idênticos ao upstrea...

Zapscape

La trilogia dell'escape KVM ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Escape da guest a host in KVM/x86 Sommario Questo documento descrive la vulnerabilità Zapscape CVE-2026-64561 scoperta e segnalata da Hyunwoo Kim @v4bel. Si tratta di una...

snapchange

Snapchange Fuzzing leggero di uno snapshot di memoria tramite KVM Snapchange offre la possibilità di caricare un dump di memoria grezzo e lo stato dei registri in una macchina virtuale VM KVM per l'esecuzione. A un certo punto dell'esecuzione, questa VM può essere ripristinata al suo stato inizia...

CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...