Loading story…
CVE-2020-27152 affects the Linux kernel's KVM hypervisor and can let a malicious or untrusted guest trigger a host-kernel stack overflow. The flaw arises during interrupt processing when lazy IOAPIC updates incorrectly set IRQ state, producing an infinite loop that exhausts the host stack and crashes the kernel.
The issue creates a guest-to-host denial-of-service risk for systems running KVM workloads, potentially disrupting every virtual machine on an affected host. Upstream Linux addressed the vulnerability in commit 77377064c3a94911339f13ce113b3abf265e06da; organizations should apply kernel updates incorporating that fix and prioritize KVM hosts exposed to untrusted tenants or guest administrators.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Prasad J. Pandit of Red Hat Product Security disclosed CVE-2020-27152, a KVM lazy-IOAPIC interrupt-processing flaw that can let an untrusted guest trigger an infinite loop and crash the host kernel. MITRE assigned the CVE identifier, and an upstream fix was made available in Linux kernel commit 77377064c3a94911339f13ce113b3abf265e06da.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
openwall.com
Open sourcecveform.mitre.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
Ubuntu disclosed mitigation guidance for **CVE-2026-53359** ("**Januscape**"), a Linux kernel local privilege escalation flaw affecting nested virtualization in **KVM** on Intel and AMD `x86_64` systems. The issue impacts Ubuntu releases from **14.04 through 26.04**, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the **hypervisor kernel**, while **unprivileged containers are not affected**; however, privileged containers and systems exposing `/dev/kvm` to non-privileged users may face elevated risk. Canonical's Ubuntu CVE tracker lists **CVE-2026-53359** among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including `linux`, `linux-hwe`, `linux-hwe-5.4`, `linux-hwe-5.8`, and `linux-hwe-5.11`, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including **CVE-2026-46331**, a `pedit` subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and **CVE-2026-52951**, a `drm/xe/dma-buf` use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.
Jul 14, 2026
**CVE-2022-39189** affects the Linux kernel’s x86 KVM subsystem, where instruction emulation can leave the `KVM_VCPU_PREEMPTED` flag set and mishandle paravirtualized TLB flushes. Other guest vCPUs may then skip required TLB-flush IPIs while emulation accesses memory using stale guest-virtual translations, enabling an unprivileged user inside a VM to compromise the guest kernel or cause guest malfunction. The issue affects the `KVM_FEATURE_PV_TLB_FLUSH` functionality introduced in Linux 4.16 and was demonstrated through emulated VMMCALL and port-I/O operations. The upstream correction, commit `6cd88243c7e03845a450795e134b488fc2afb736`, was merged for Linux 5.19 and backported to the stable 5.15 and 5.18 kernel trees; affected kernels are generally versions before 5.18.17. Red Hat rated the vulnerability Moderate with CVSS 7.0 and issued fixes for affected RHEL 8, RHEL 8 kernel-rt, RHEL 8.6 EUS, RHEL 9, RHEL 9 kernel-rt, and Red Hat Virtualization 4 on RHEL 8 packages; Red Hat reported no qualifying mitigation, making deployment of the relevant kernel updates the required remediation.
Aug 26, 2026