Loading story…
Linux KVM's mitigation for Intel Transaction Asynchronous Abort (TAA), tracked as CVE-2019-11135, was found incomplete and assigned CVE-2019-19338. On TAA-vulnerable Cascade Lake hosts with TSX enabled but unaffected by Microarchitectural Data Sampling (MDS), KVM could expose MDS_NO=1 to guests, causing them to omit the required VERW-based clearing of CPU buffers despite remaining susceptible to TAA. Upstream fixes export MSR_IA32_TSX_CTRL to guests or, alternatively, report MDS_NO=0 when TSX remains enabled; KVM also uses the control MSR to disable RTM in guests when the host does not expose it.
Red Hat released updated qemu-kvm packages for RHEL 7 through RHSA-2020:0366 to address the TAA issue, the KVM architectural-capabilities/CPUID exposure problem, and QEMU slirp heap buffer overflow CVE-2019-14378. Administrators should install the update and fully shut down and restart every running virtual machine, as guest restarts are required for the new CPU-feature and mitigation exposure settings to take effect.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2020:0366 for RHEL 7, providing updated qemu-kvm packages that remediate Intel TAA (CVE-2019-11135) and the QEMU slirp heap buffer overflow CVE-2019-14378. The update also addressed KVM architectural-capabilities CPUID exposure and added MDS_NO exposure to guest VMs; administrators were instructed to restart all VMs after installation.
Red Hat assigned CVE-2019-19338 to an incomplete Linux KVM mitigation for Intel Transactional Asynchronous Abort (CVE-2019-11135). On TAA-vulnerable Cascade Lake hosts with TSX enabled and MDS_NO=1, guests could be prevented from using VERW to clear affected CPU buffers.
An upstream Linux KVM VMX patch added handling for the guest MSR_IA32_TSX_CTRL, disabling RTM/TSX for guests when RTM is not exposed and centralizing shared guest-MSR updates. The patch was among upstream changes provided to address the incomplete TAA mitigation scenario.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceopenwall.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-39189** affects the Linux kernel’s x86 KVM subsystem, where instruction emulation can leave the `KVM_VCPU_PREEMPTED` flag set and mishandle paravirtualized TLB flushes. Other guest vCPUs may then skip required TLB-flush IPIs while emulation accesses memory using stale guest-virtual translations, enabling an unprivileged user inside a VM to compromise the guest kernel or cause guest malfunction. The issue affects the `KVM_FEATURE_PV_TLB_FLUSH` functionality introduced in Linux 4.16 and was demonstrated through emulated VMMCALL and port-I/O operations. The upstream correction, commit `6cd88243c7e03845a450795e134b488fc2afb736`, was merged for Linux 5.19 and backported to the stable 5.15 and 5.18 kernel trees; affected kernels are generally versions before 5.18.17. Red Hat rated the vulnerability Moderate with CVSS 7.0 and issued fixes for affected RHEL 8, RHEL 8 kernel-rt, RHEL 8.6 EUS, RHEL 9, RHEL 9 kernel-rt, and Red Hat Virtualization 4 on RHEL 8 packages; Red Hat reported no qualifying mitigation, making deployment of the relevant kernel updates the required remediation.
Aug 26, 2026
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
Ubuntu disclosed mitigation guidance for **CVE-2026-53359** ("**Januscape**"), a Linux kernel local privilege escalation flaw affecting nested virtualization in **KVM** on Intel and AMD `x86_64` systems. The issue impacts Ubuntu releases from **14.04 through 26.04**, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the **hypervisor kernel**, while **unprivileged containers are not affected**; however, privileged containers and systems exposing `/dev/kvm` to non-privileged users may face elevated risk. Canonical's Ubuntu CVE tracker lists **CVE-2026-53359** among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including `linux`, `linux-hwe`, `linux-hwe-5.4`, `linux-hwe-5.8`, and `linux-hwe-5.11`, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including **CVE-2026-46331**, a `pedit` subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and **CVE-2026-52951**, a `drm/xe/dma-buf` use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.
Jul 14, 2026