Runbook hardens shared Linux hosts against cache covert channels
The guide covers KVM, Firecracker and QEMU: separate cores, disable KSM, keep CPU mitigations, and partition L3 with resctrl.
42
- Mentions · 7d0
- Mentions · 30d7
- All mentions13
- First seenSep 16, 2026
- Last mentioned15d ago
Timeline
13 articles · newest firstLinux networking flaw lets KVM guests escape to the host
Pwn.ai leaked host memory on Vercel production sandboxes and gained root on lab hosts; guest-only updates do not fix it.
84
Linux KVM/x86 stale SMM MMIO cache bypasses write tracking
A guest can make a tracked RAM write look like KVM_EXIT_MMIO, so a VMM may change the page without write tracking.
52
Linux kernel patch closes PwnEscape KVM guest-to-host escape
CVE-2026-99999 lets an x86 KVM guest alter already-validated IP packets, read host memory, and potentially run code.
74
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
Researchers show CVE-2026-99999 lets a KVM guest escape to the host via Linux checksum handling.
76
Linux kernel gets a fix for a flaw that enabled attackers to escape VMs
Linux patched CVE-2026-99999, a networking flaw researchers used to escape VMs to the host.
80
linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
A write-up claims Linux KVM guest-to-host escape CVE-2026-99999, so far described as host-memory disclosure.
72
Re: cloud computing provider disclosures
oss-security reply says Xen, KVM, QEMU, and Cloud Hypervisor already have separate disclosure processes.
22
Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000
Vercel confirmed researcher Paulos Yibelo's KVM zero-day guest-to-host root escape and paid a $50,000 bounty.
74
Linux KVM/x86 (tested on 6.1.74): guest-triggered host panic via SMM shadow MMU
A KVM x86 shadow-MMU bug lets an L1 guest panic the Linux host via nested VMX and SMM.
56
Linux KVM/arm64 Vulnerability Lets Attackers Escape Virtual Machines and Gain Host Access
CVE-2026-89775 lets a malicious ARM64 KVM guest skip TLB invalidation and access host memory.
68
Critical Linux KVM Flaw Enables Guest-to-Host Escape on ARM64 Systems
A Linux KVM bug on ARM64 with nested virtualization can let a guest read and write host kernel memory.
61
CVE-2026-89775: Guest-to-Host Escape in KVM/arm64
Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.
56
Related CVEs
by mentions- CVE-2026-99999<1%9.3Linux kernel IPv4 checksum metadata can corrupt headers
- Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposure
Appears with
- Linux kernelproduct · 9
- Firecrackerproduct · 5
- Vercelorganization · 5
- Linuxvendor · 4
- pwn.aiorganization · 4
- Vercel Sandboxproduct · 2
- Amazon Web Servicesvendor · 2
- Red Hatvendor · 2
- QEMUproduct · 2
- OpenShift Container Platformproduct · 1
- virtio-netproduct · 1
- Xen Projectorganization · 1
- Xenproduct · 1
- GPT-5.6 Solai model · 1
- Red Hatorganization · 1
- Amazon EC2product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.