Repository navigation
Host kernel CVEs reachable from guests: CVE-2026-99999, Januscape, ITScape #90
Description
Three Linux host-kernel bugs are reachable from inside a Hyper guest. None is in Hyper's code and no Hyper release fixes them: operators have to patch the host kernel.
| CVE | Bug | Arch | How a guest reaches it | Upstream fix |
|---|---|---|---|---|
| CVE-2026-99999 | ipv4: checksum completion trusts an unvalidated csum_start |
all | Firecracker's virtio-net hands the guest's virtio_net_hdr to tap0 (IFF_VNET_HDR, VIRTIO_NET_F_CSUM), and every guest packet is IPv4-forwarded twice: the netns NAT, then the host masquerade |
6785011f8b16 |
| CVE-2026-53359 (Januscape) | KVM x86 shadow MMU use-after-free | x86_64 | needs VMX/SVM in the guest. Firecracker 1.16.0 doesn't mask either bit and we send no /cpu-config, so guests get nested virt whenever the host's kvm_intel/kvm_amd nested param is on, which is the default |
81ccda30b4e8 |
| CVE-2026-46316 (ITScape) | KVM arm64 vgic-its use-after-free | aarch64 | Firecracker 1.16.0 creates a vGIC ITS for every VM | stable commits on NVD |
Each needs root or kernel code in the guest. Hyper runs arbitrary OCI images, so assume the guest has it. The reachability column comes from reading Firecracker v1.16.0 and our netns plumbing; none of the three has been reproduced on a Hyper node.
No separate CVE for Hyper: the kernel CNA already assigned these IDs, and every Hyper version is equally exposed.
Operators:
- Move to a host kernel carrying the fixes. Check your distro's kernel changelog or security tracker for the CVE IDs or the fix subjects:
ipv4: validate checksum_start before completing checksum,KVM: x86: Fix shadow paging use-after-free due to unexpected role,KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry. - On x86_64, until the host is patched or feat(fire_vmm): mask VMX and SVM from guests via /cpu-config #91 ships, turn off nested virt:
echo 'options kvm_intel nested=0' | sudo tee /etc/modprobe.d/hyper-no-nested.conf(kvm_amdon AMD), thensudo modprobe -r kvm_intel && sudo modprobe kvm_intelwith no VMs running. Inside a VM,grep -cE 'vmx|svm' /proc/cpuinfomust print0. - CVE-2026-99999 has no known workaround short of the kernel fix.
Hyper:
- feat(fire_vmm): mask VMX and SVM from guests via /cpu-config #91 mask VMX/SVM from guests via
/cpu-config - docs: state host kernel requirements in install.md #92 host kernel requirements in
install.md - docs: add SECURITY.md #93
SECURITY.md, plus turning on private vulnerability reporting
Activity