Topic
Security of hypervisors and the isolation between guest virtual machines and hosts, including VM escape flaws and virtualization management software.
Tencent Zhuque Lab published working demos on October 12 for Vghost (CVE-2026-74580), a vhost bug that gives local users root on Linux 4.11 through 7.2-rc4. The August 3 fix is out, but Ubuntu 24.04 and 26.04 kernels were still listed as in progress on October 13.
Reality
Meta engineers responded to a spike in reported KVM escapes shortly before launching Muse, 404 Media reported in October 2026. The issues were fixed before launch, a dev.to summary says, and no exploit details are public.
Reality
CVE-2026-59310 gave a suspected APT crew persistence on vCenter systems in August. CISA has now flagged the same directory traversal as abused by ransomware operators. Broadcom patched it on July 29.
Reality
Hyunwoo Kim says a guest can use the bug to run code on the host, and he reports a local-root variant where /dev/kvm is world-openable. Both need ARM64 nested virtualization, a mode that is off by default.
Reality
Broadcom's VMSA-2026-0007 fixes an integer overflow in the VMXNET3 adapter and a stack overflow in HGFS, both reachable by a local administrator inside the VM, and the only remedy on offer is version 26H1u1.
Perspective Coverage
3 publishersReality