Galaxy S26 Ultra: untrusted_app → root.
Introducing "Infinity Core": 6 vulns in the Linux kernel's core subsystems.
Their impact spans Linux server LPE, container escape, and Android LPE.
Details: github.com/V4bel/InfinityCor…
Nice. This year is the year of the VM escape.
But I read the kvm ML and tree daily, and nothing in the recent public kvm patches looks like a microvm escape. Probably not "kvm" but another virt stack.
Maybe I missed it, or a stealth merge is coming. Curious either way.
🤔
Orphaned VMs: Running VMs Uninterrupted While Host Kernel Is Offline For Reboots/Updates
Next level craziness out of Google!! Keeping the VMs running while the host kernel is down for live updates. Experimental Linux patches posted.
phoronix.com/news/Orphaned-V…
Another month, another KVM escape.
Patch if you're affected.
openwall.com/lists/oss-secur…
Well, I think I should be getting some marketing incentives here. lol
blog.cloudlinux.com/januscap…
Won Best RCE and Best PE at the Pwnie Awards 2026 🏆🏆
Three of my projects were nominated this year, and ITScape and Dirty Frag took home the awards.
That makes three Pwnies in total, following last year’s Best PE.
Pwnie is probably the award that motivates me the most.
Next year’s goal: find a vuln that destroys the world ;)
Thank you, @PwnieAwards!
💥 Introducing "Zapscape" (CVE-2026-64561)
A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU's recursive "ZAP" path. Can escape to the host on x86 public clouds that expose nested virtualization.
A separate vulnerability from Januscape. If you match the vulnerable conditions, apply the patch immediately.
Details: zapscape.io
Interesting.
Nous avons terminé la compagne de patching du jbug critique CVE-2026-53359 dans KVM. Vu le niveau critique du bug, nous n'avons pas communiqué avant de démarrer le patching, il fallait aller vite. Maintenant que l'infra est en sécurité, voici le REX.
blog.ovhcloud.com/campagne-d…
"Januscape" only triggers on Intel and AMD hosts, but if you still haven't patched "ITScape", your arm64-based hosts are at risk too, so apply the patch promptly.
teapaw.org/v4bel/status/206477614…
🚨 Introducing "ITScape" (CVE-2026-46316)
A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel.
Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds.
To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64.
Details: itscape.io
💥 Introducing "Januscape" (CVE-2026-53359)
A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU. Triggerable on both Intel and AMD hosts. Threatens x86 public clouds (GCP, AWS) that expose nested virtualization.
"16 years" latent. Successfully used as a 0-day exploit in "Google kvmCTF".
To the best of public knowledge, the first KVM exploit research triggerable on both Intel and AMD.
Details: januscape.io
🚨 Introducing "ITScape" (CVE-2026-46316)
A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel.
Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds.
To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64.
Details: itscape.io
The patch addressing several Dirty Frag variants has been merged into netdev tree.
Details: seclists.org/oss-sec/2026/q2…
Well... not a bad result, considering I got the last slot 😜
Confirmed! Hyunwoo Kim (@v4bel) chained a use-after-free and uninitialized memory bug to escalate privileges on Red Hat Enterprise Linux for Workstations in the fourth round, earning $5,000 and 2 Master of Pwn points. #Pwn2Own #P2OBerlin
