Zapscape

KVM 逃逸三部曲 ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape：KVM/x86 中的客户机到宿主机逃逸 摘要 本文档描述了由 Hyunwoo Kim @v4bel 发现并报告的 Zapscape CVE-2026-64561 漏洞。这是一个 KVM 逃逸漏洞，允许客户机在 KVM/x86 环境中逃逸到宿主机，并以内核（root）权限在宿主机上执行命令。 Zapscape 是 KVM/x86 的影子 MMU（shadow...

Januscape

Januscape: KVM/x86におけるゲストからホストへの脱出 概要 このドキュメントは、Hyunwoo Kim @v4bel によって発見・報告された Januscape CVE-2026-53359 脆弱性について説明します。これはKVM/x86環境においてゲストからホストへの脱出を可能にするKVMエスケープ脆弱性です。公に知られている限り、これはIntelとAMDの両方でトリガー可能な初のゲスト-to-ホストエクスプロイト研究であり、単一アーキテクチャに限定されません。 JanuscapeはKVM/x86のシャドウMMU...

hyperv_local_dos_poc

Hyper-V DoS PoC。 これはVisual Studio 2019ドライバプロジェクトのコードファイルです。 1. ドライバをコンパイルします。 2. 次のコマンドを使用して、ゲストOSのネストされた仮想化を有効にします: Set-VMProcessor -VMName -ExposeVirtualizationExtensions $true 3. ゲストOS内でドライバを実行します。ホストOSが再起動されるか、HYPERVISORERRORコードでBSODが発生します。 バグはHyper-V（Windows Server 2019、最新パッチ適用済みWindows 10、お...

CVE-2021-3656-Demo

CVE-2021-3656: この問題は、virtext VMCB フィールドの検証が欠落しているために発生し、悪意のある L1 ゲストが L2 ゲストの VMLOAD/VMSAVE インターセプトと VLS Virtual VMLOAD/VMSAVE の両方を無効にできるようになります。このような状況では、L2 ゲストは VMLOAD/VMSAVE をインターセプトなしで実行でき、ホストの物理メモリの一部を読み書きできます。 Linux カーネルにアクセスするための環境セットアップ: 1. Docker コンテナまたは仮想マシンを使用できます。私は docker コンテナでやってみます...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2021_3547)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213547 advisory. kernel: SVM nested virtualization issue in KVM AVIC support CVE-2021-3653 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc (crlsa-2021_3548)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213548 advisory. kernel: SVM nested virtualization issue in KVM AVIC support CVE-2021-3653 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786761805)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786761805 advisory. - A flaw was found in the KVM's AMD nested virtualization SVM. A malicious L1 guest could purposely fail to intercept the shutdown ...

KVM-Januscape

KVM-XJ ホットパッチ dumptool.py はオフセットを自動検索するためのものです。使い方はコードを見てください。 脆弱性概要 CVE-2026-53359（Januscape）は、Linux カーネル KVM シャドウ MMU における Use-After-Free（UAF）脆弱性です。 潜伏期間：16 年（2010年8月～2026年7月） 影響範囲：ネステッド仮想化を有効にしたすべての Intel/AMD x86 システム 危険度：高、VM 内の root ユーザーがホストに脱出し、ホストの root 権限を取得可能...

CVE-2026-64561

CVE-2026-64561 — Zapscape:KVM/x86 shadow MMU UAF,guest 逃逸到 host root HackSpeak 分发镜像。本仓库为研究员 Hyunwoo Kim@v4bel公开的完整 PoC + 技术文档的分发镜像 ,代码与文档与上游一致。 ⚠️ 上游未附 LICENSE :镜像按分发惯例采用 MIT License,Copyright c 2026 HackSpeak ,源码版权归原代码作者 V4bel / @v4bel。PoC 未经真机验证 ,请先在可销毁环境QEMU TCG测试,勿对未授权目标使用。 漏洞简述...

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the...

SUSE CVE-2026-89929

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

AZL-101610 CVE-2026-89932 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

DEBIAN-CVE-2026-89929

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

CVE-2026-89932 KVM: nVMX: Always flush vpid02 on first use

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

EUVD-2026-80532

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting lastvpid=0 when allocating vpid02. nestedvmxtransitiontlbflush will always detect a VPID change on first VM-Enter after VMXON,...

CVE-2026-89929

CVE-2026-89929 affects the Linux kernel KVM subsystem, specifically the nested virtualization (nVM ) code path that emulates the INVVPID instruction. When a guest L1 vCPU migrates between physical CPUs and issues INVVPID, KVM executes the instruction on the current physical CPU rather than the on...

Linux Distros Unpatched Vulnerability : CVE-2026-89929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1...

CVE-2026-89929: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nSVM module. When a nested virtual machine L2 guest executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor L1, KVM incorrectly uses vmcb02 instead of vmcb01 for managing guest state...