Posted by Jinu Kim on Sep 29 Hello, I found a guest-triggerable host-kernel panic in KVM's x86 shadow MMU. I reproduced it on Linux 6.1.74 and on pre-fix mainline. An attacker with kernel-level control of an L1 guest can reach it; my reproducer uses nested VMX/EPT, Q35 SMM, and two vCPUs.
Linux KVM/x86 (tested on 6.1.74): guest-triggered host panic via SMM shadow MMU
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/978
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
USN-8728-3: Linux kernel (Oracle) vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated…
Linux security advisory (AV26-970)
Serial Number: AV26-970 Date: September 28, 2026 Linux security advisory (AV26-970) As of September 25, 2026, Linux is affected by a vulnerability in the following…
SUSE Linux security advisory (AV26-968)
Serial Number: AV26-968 Date: September 28, 2026 As of September 28, 2026, SUSE is affected by a vulnerability in the following product: NeuVector Prior to 5.4.11 Prior…
Other users can watch your browsing and time your keystrokes through OS file notifications
Researchers at Graz University of Technology have used the file-notification systems in Windows, Linux, and macOS to spy on activity in other accounts. On Windows, a…
Security Affairs newsletter Round 597 by Pierluigi Paganini – INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new…
[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)
Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Server Technology (Legrand group) PRO3X series…