I FOUND A VM ESCAPE BUG IN KVM AND SOMEONE ELSE GOT THERE FIRST

Summary from the TLDR InfoSec newsletter

A malicious VM could trigger a repeatable heap out-of-bounds read/write escape in KVM's SEV-SNP Page State Change handler due to a bounds check that validated against a protocol constant rather than the actual, guest-controlled scratch buffer size. This flaw yielded five powerful primitives, including a failure oracle, a GFN leak, and guest-controlled slab selection. Tracked as CVE-2026-53360, the vulnerability affects kernels since v6.10 and was ultimately mitigated in versions v7.0.12, v6.18.35, and v6.12.93 by rejecting external scratch allocations entirely and adding READ_ONCE() to close a TOCTOU window, underscoring the need to validate against actual allocation sizes rather than protocol maximums.