Exploit / PoCcritical
Januscape: 16-Year-Old Linux KVM Bug Enables Cloud VM Escape Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) | 8.8 | 94% | PoC | |
| CVE-2026-43500 | Out-of-bounds write in Linux kernel AF_RXRPC decryption enables root access | 7.8 | 93% | ||
| CVE-2026-46316 | Linux kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry… | 9.3 | <1% | ||
| CVE-2026-53359 | Linux kernel: KVM: x86 | 8.8 | <1% |
From the original article
4 min read at securityaffairs.com
Januscape: A 16-year-old Linux KVM flaw lets cloud VM tenants crash hosts and potentially escape guests. It affects Intel and AMD systems. Security researcher Hyunwoo Kim has published details of a use-after-free vulnerability in Linux’s KVM hypervisor that allows code running inside a guest virtual machine to corrupt host kernel memory.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.