Byepervisor Reborn: The PS5 Hypervisor Is Blown Wide Open — and Linux Finally Has an Opening

For four years, the PlayStation 5's hypervisor has been the fortress wall of Sony's security model — the privileged layer that isolates the console's game operating system from the hardware, and the single biggest reason a retail PS5 has never booted anything but PlayStation software. That wall just came down. A new developer release from the PS5Dev collective, Byepervisor Reborn, defeats the PS5 hypervisor on firmware 13.60 and below, granting read/write access to the hypervisor's own memory and to every live virtual-machine control block on the console.

The project lands with a fittingly understated description — “Somehow, Byepervisor returned…” — and it is a direct, pointed callback to 2024's original Byepervisor, the hypervisor exploit that dominated early-firmware PS5 (1.xx–2.xx). This time, the team has resurrected the concept for modern firmware, and in doing so has removed the last major technical barrier standing between a retail PlayStation 5 and a wholly different operating system — Linux.

What Just Happened

Byepervisor Reborn is a PS5 hypervisor exploit — not a kernel exploit, and certainly not a userland bug. Kernel exploits on the PS5 have been public for a while; they let you gain code execution inside Sony's game OS with full kernel privileges. But the hypervisor sits above that kernel, enforcing isolation with hardware virtualization. A compromised kernel alone still can't see the hypervisor's memory, can't touch the VM control blocks that define the platform's security boundaries, and can't disable the protections that keep the console locked to PlayStation OS.

Byepervisor Reborn crosses that final boundary. As its README puts it plainly, the payload “should leave the system in a state where the kernel can be dumped and patched” — with XOM/xotext disabled and kernel write enabled. Upon resuming from rest mode, it even prints the first eight bytes of the kernel's .text section as a notification, a cold little victory lap proving that execute-only memory protection (XOM) has been defeated.

The short version: A prior kernel-level compromise has long been the price of entry. Byepervisor Reborn is what happens after that — it takes a compromised GameOS kernel and turns it into control over the hypervisor itself, the very layer that is supposed to make such a thing impossible.

The Bug: A One-Shot Window Left Open on Resume

The vulnerability — documented in a detailed write-up by researcher soniciso1 and classified as CWE-665: Improper Initialization — lives in the hypervisor's application-processor startup path. On the PS5, the hypervisor runs GameOS as a guest and enforces isolation using two nested page table (NPT) roots:

Every virtual core carries a selector, cur_npt, that says which root applies to it, and a one-shot startup_mp bitmap gates how many times an application processor (AP) may be started. The AP-start primitive itself is hypercall 0x0f (khv_startup_mp), which takes a core, a start RIP, and a CR3 page-table root straight from guest registers. Its only guards are core < 16 and whether the one-shot bit is already spent.

Here's where it unravels. When the console enters S3 (suspend-to-RAM) and resumes, the hypervisor reinitializes its writable state: the startup_mp bitmap is cleared, and every freshly initialized vcore gets cur_npt = 0 — the host view. The climb back to Root 1 is lazy: it only happens the first time a core fetches GameOS kernel text. Only the boot processor (core 0) makes that fetch during resume, so cores 1–15 are left parked at Root 0, with hypervisor memory fully mapped, until GameOS wakes them. And in the narrow window between resume and the normal wake loop, hypercall 0x0f is still live and still accepting guest-supplied arguments.

That is the entire exploit: a compromised kernel invokes HCALL 0x0f for a high core number, pointing the start RIP at attacker shellcode staged in a surviving executable carrier page and the CR3 at an attacker-controlled page table. The launched core never fetches GameOS text, so it never promotes to Root 1 — and it runs with the hypervisor's own memory live in its address space.

The primitive that matters: From there, the payload walks the hypervisor's CPU array and derives each VMCB's physical address. It located all sixteen live GameOS VMCBs and performed a write/read-back/restore on every one. A write primitive to a VMCB page is, by extension, a write primitive to NESTED_CR3 — the field that actually enforces the GameOS/hypervisor separation. The proof deliberately left that field untouched.

Why This Opens the Door to Linux

Running Linux on a PlayStation 5 has always been a two-part problem. The first part — gaining code execution and kernel control — has been solved repeatedly over the past year. The second part is the hard one: the hypervisor.

The hypervisor is precisely what makes an alternative operating system so difficult. It abstracts the hardware, enforces memory protections, and holds the virtual-machine state that GameOS depends on. As long as it remains intact and untouchable, any Linux attempt is fighting a layer it cannot see or reason about. Seizing control of the hypervisor — its memory, its VMCBs, and the NESTED_CR3 roots that define isolation — is the missing piece. With XOM defeated and kernel memory writable and patchable, the platform's protection model becomes something the console's owner can actually stand on top of rather than be boxed in by.

That shift is what turns a theoretical “PS5 Linux” into an engineering project rather than a fantasy. The console's hardware — an AMD Zen 2 CPU, RDNA 2 graphics, unified DDR5 memory, and PCIe NVMe storage — is, architecturally, an ordinary x86-64 PC. The only thing separating it from any other Linux machine has been software lock-in, and Byepervisor Reborn removes the deepest, most stubborn layer of that lock-in.

An honest caveat: Byepervisor Reborn does not ship Linux, and running an alternative OS is not a button you press after loading it. It is a base exploit — a foundation other developers are meant to build on. What it changes is the ceiling: the hypervisor is no longer the reason Linux is impossible on a retail PS5.

The Fine Print (Read This Before You Get Excited)

The PS5Dev team is refreshingly blunt about scope. Their README opens with a direct warning: “This repo should be considered a base exploit for work to be built on top of. It is not useful to regular users in its current release state, this is intended for developers.” Keeping that in mind:

• Firmware support: Only 13.60 and 13.20 are fully supported; 13.00 is included but untested. The bug is theoretically exploitable as far back as 6.xx, and could be adapted to 14.00 — but that isn't provided here (not least because no public 14.00 kernel exploit exists yet).
• You still need a kernel exploit: Byepervisor Reborn is a boundary crossing that occurs after GameOS is already compromised. It runs through the community elfldr payload loader, and relies on it surviving the rest-mode round trip.
• No patches are included: There is no HEN, no jailbreak payload, no auto-applied patch set. The team describes it as a “bring your own patches scenario” — they simply left that work for others.
• Pro vs. non-pro matters: The exploit must know whether the console is a standard or Pro unit, because the added 2 GB of DDR5 on Pro models is (in the team's words) “wasted on the hypervisor” at a different physical address — 0x062800000 for non-Pro, 0x8E0800000 for Pro.
• Rest mode is mandatory: You'll likely need to enable Settings → System → Power Saving → Features Available in Rest Mode → Supply Power to USB Ports: Always. The exploit fires on the S3 resume path, so if the console powers off instead of resuming, that means it failed — though the team rates the technique as “99.9% stable” when your configuration is supported.

A Community Effort, Years in the Making

The lineage of this bug is a great illustration of how modern console research actually happens. According to the project and its write-up, the underlying flaw was first discovered by theflow0 — one of the most respected names in PlayStation security — and was then independently rediscovered more recently by several researchers, notably with the assistance of large language models, a detail that has quietly become a recurring theme in 2026's exploit scene.

The write-up is credited to soniciso1, the repository was committed by ChendoChap, and the whole effort is published under the PS5Dev organization. It is a deliberate spiritual successor to the group's 2024 Byepervisor, which targeted 1.xx–2.xx firmware and reached over 360 stars — the reason this release carries such a knowing name.

Editorial: Sony Has Been Taking You for a Ride — And We Have to Stop Forgetting

Let’s be honest about what we’re actually celebrating here, because it’s bigger than a clever hypervisor exploit and a tidy stack of GitHub stars. PS5 homebrew, the PS5 jailbreak scene, PS5 Linux, PS5 emulation, backwards compatibility, game preservation, reverse engineering, digital ownership, DRM, and the entire “right to repair your own console” movement all exist for one deeply embarrassing reason: a paying customer who already handed Sony several hundred dollars for a console — and then several hundred more for games — still is not allowed to use the hardware they bought.

That’s the part that should make you angry. Not “annoyed.” Not “mildly inconvenienced.” Angry. You bought the plastic. You bought the silicon. You bought the disc, or the download, or the “digital deluxe” edition, or the season pass, or the remaster of the remake of the thing you already own. And after all of that, Sony still gets to decide that the machine on your shelf is their machine, running their rules, locked to their storefront, forever.

The Repurchase Machine: Buy the Same Game Five Times, Then Buy It Again

This is the oldest trick in the PlayStation playbook, and it never stops. You bought Final Fantasy VII on a PS1 disc. Then Sony happily sold it to you again as a PS1 Classic on PS3. Then again on PSP and PS Vita. Then again on PS4. Then again on PS5 under the PS Plus Premium classics catalog — a subscription, naturally, that you lose the moment you stop paying. The same game. The same disc. The same file. Bought over and over and over, each time dressed up as a “feature,” each time with a new storefront and a new receipt, each time with a wall between you and the version you already own.

Meanwhile, the machine sitting under your TV physically cannot read a PS1, PS2, or PS3 disc. Not because the hardware can’t — the PS5 is an AMD Zen 2 / RDNA 2 computer that laughs at the workload of emulating a 1994 console — but because of business decisions. Modders and open-source developers have already proven, in public, on the same silicon, that PS1 emulation (DuckStation), PS2 emulation (PCSX2), and even PS3 emulation (RPCS3) run spectacularly well on PlayStation 5-class hardware. The technology has been sitting right there, ready, for years. Sony simply chose not to ship it, because a console that plays your old discs is a console that doesn’t need to sell you your old games again.

The receipts don’t stop: Sony announced the shutdown of the PS3 and PS Vita stores in 2021 — then reversed course only after a backlash loud enough to threaten the stock price. That’s the game. Push until people push back. Sell access, not ownership. Rent you your own library. Call it “legacy support” and monetize the word “legacy.”

And Then There’s the Media Playback. The PS5 Can’t Even Play an MP3.

Breathe that in for a second. A $500 gaming console, in the year 2026, that markets itself as a premium all-in-one entertainment hub for your living room, cannot play a folder of MP3s the way a $30 MP3 player from 2004 could. No proper local music library. No audio CD playback through the disc drive you paid a premium for. No web browser worth the name. A box built on top of a general-purpose computer that goes out of its way to be less useful than the PC it’s based on — and, in several respects, less useful than the PS4 it replaced, which at least handled USB music and let you customize your home screen.

That isn’t a technical limitation. It’s not a bug. It’s a product decision — a deliberate narrowing of what your hardware is permitted to do, so that the only place your media and your money can live is inside Sony’s ecosystem, subject to Sony’s licenses, Sony’s servers, and Sony’s terms of service. It is anti-consumer by design, and it is embarrassing.

Planned Obsolescence Isn’t a Bug — It’s the Business Model

Every console generation the same cycle plays out like clockwork. A new box arrives. Backwards compatibility quietly disappears, or becomes a paid tier. Old storefronts are shuttered. Online servers get sunsetted, and the games you played with friends become hollow menus that politely tell you to reconnect to a service that no longer exists. The digital games you “bought” turn out to have been licensed — and licenses expire. Meanwhile, the physical discs you paid full price for gather dust because the new machine refuses to acknowledge they exist. This isn’t neglect. This is manufactured obsolescence dressed up as progress, and it is the single most reliable engine in the entire industry.

Never Trust These Corporations Again

Here’s the uncomfortable truth that the PlayStation 5 jailbreak, PS5 homebrew, and the whole reverse-engineering scene keep proving over and over: a multi-billion-dollar corporation will never love you back. It will optimize for the next quarter’s earnings call, close the store the moment it stops penciling out, and sell you the same 1997 game until the heat death of the universe. Every “customer-friendly” reversal — a walk-back on store closures, a reluctant feature patch — happened because people screamed, not because anyone upstairs suddenly grew a conscience. The lesson is simple and permanent: you cannot trust DRM, you cannot trust the cloud, and you cannot trust the company that sold you the hardware. You can only trust the community.

The Golden Age of Reverse Engineering Is Here — And It’s Beautiful

And that community is, right now, in the middle of a genuine golden age of reverse engineering, game preservation, static recompilation, decompilation, and open-source emulation. On the N64, projects like N64Recomp are turning retail cartridges into native PC executables. On the PC side, static recompilers are rebuilding entire 2000s-era classics in modern C. On the PlayStation front, RPCS3 has dragged the “impossible” Cell processor into the modern era, PCSX2 handles PS2 with terrifying accuracy, and DuckStation nails PS1. And now — thanks to the S3-resume AP-launch bug in Byepervisor Reborn — the PS5’s own hypervisor, the deepest layer of corporate control Sony ever built, has been cracked open on modern firmware.

Read that list again. The enthusiasts, hobbyists, and unpaid researchers are out-engineering the billion-dollar company. They aren’t doing it for a quarterly bonus. They’re doing it because they believe your hardware should obey you, your games should outlive their storefronts, and history should not be deleted to protect a spreadsheet. That is a movement worth being angry for.

Make Your PS5 the Console It Was Supposed to Be

So here is the call to action, and it’s a loud one. Once you’re on a supported firmware, the artificial walls start to fall:

• Jailbreak your PS5 and run the homebrew and payloads the community has built — and stop treating your own hardware like a rental.
• Play your backups and your own discs. Preservation isn’t piracy; it’s refusing to let a licensing server decide which parts of your library still exist.
• Run emulators. PS1, PS2, PSP, and beyond — the exact software Sony could have shipped for free and chose not to.
• Bring back the media features Sony removed. Your music, your files, your media — on the machine you paid for.
• Install Linux. Turn the PlayStation 5 into an actual computer — a real desktop, a workstation, a home server, a living-room PC. With the hypervisor defeated, this is no longer a fantasy; it’s a frontier. We don’t have a step-by-step Linux installation guide yet — this exploit is a base for developers, not a one-click installer — but the wall that stood in the way for four years has just been knocked down, and the people who knocked it down are already moving.

For twenty-five years we’ve been trained to say thank you for the privilege of being locked out of our own machines. That era is ending. The PS5 hypervisor has fallen, the emulators already run better than the official “classics” ever did, and a small army of volunteers just proved — again — that given a little time, they can build the console Sony never wanted to sell you. So no: we should never trust these corporations ever again. We should trust each other, we should back up our games, and we should make our hardware ours.

What Comes Next

Byepervisor Reborn is a starting gun, not a finish line. Expect the community to use it as the foundation for the usual next steps: kernel patches and a HEN-style payload, hypervisor-level tweaks, and — most tantalizing of all — renewed work on booting an alternative operating system. With the hypervisor's memory now in play, a PS5 running Linux is no longer blocked by the platform's deepest defense; it is blocked only by the engineering required to bring such a system up, which is precisely the kind of problem this scene loves to solve.

For a console whose entire design philosophy is about control, that is a genuinely historic crack in the armor. The PS5's most trusted layer — the one Sony built an entire virtualization stack to protect — has been defeated on modern firmware, and the long-promised dream of a PlayStation that runs Linux just took its single biggest step toward reality.

Resources & Links

• Repository: PS5Dev/Byepervisor-Reborn on GitHub
• Technical Write-up: The S3-Resume khv_startup_mp AP-Launch Bug (HCALL 0x0f)
• Original Exploit (2024): PS5Dev/Byepervisor — the 1.xx–2.xx hypervisor exploit
• Payload Loader: ps5-payload-dev/elfldr
• Build SDK: PS5-Payload-Dev SDK
• Requirements: A PS5 on firmware 6.xx–13.60 with an existing kernel exploit chain and elfldr. Developer use only — no patches or user-facing tooling included.