ps5-linux-loader: Linux payload implementing HV exploits to run a custom bootloader
The execution of arbitrary operating systems on modern, highly restricted console hardware represents a significant milestone in system security and reverse engineering. The ps5-linux-loader project, developed by open-source collaborators within the ps5-linux organization and published via GitHub and community platforms like Lobste.rs, delivers a bootloader payload that exploits PlayStation 5 hypervisor vulnerabilities to run a custom Linux distribution on firmware versions 3.00 through 7.61. This work bridges the gap between sandboxed console architectures and general-purpose computing, allowing users to leverage the console's custom AMD-based SoC—comprising 8 CPU cores operating at 3.5 GHz and an RDNA 2-based GPU at 2.23 GHz—for high-performance desktop applications, Steam gaming, and system emulation.
At the core of this implementation are two critical technical mechanisms: hypervisor exploit integration and custom device driver engineering. To bypass the PS5's secure virtualization layers, the loader relies on chained kernel exploits, specifically utilizing the umtx2 userland-to-kernel vulnerability chain on lower firmwares and the Y2JB exploit framework on newer versions up to 7.61. The system utilizes a bootstrap sequence that leverages the console's Rest Mode state as a transition vector, allowing the system to pivot from the proprietary PlayStation operating system to a bare-metal Linux environment upon hardware wakeup. Furthermore, because console hardware diverges from standard PC architecture, the project implements custom-written drivers, including a specialized AHCI driver for the Blu-ray drive, an XHCI-compatible driver for internal Bluetooth, and a GBE driver for native Ethernet connectivity.
This project is primarily designed for security researchers, kernel developers, and console homebrew engineers interested in low-level hardware initialization and virtualization security. By demonstrating how to bypass hypervisor controls and expose raw hardware to user-controlled kernels, the project paves the way for deeper research into AMD SoC security architectures and the development of open-source graphics drivers under non-standard firmware environments. It is important to note that the analyzed source material is a technical installation guide and repository documentation rather than a peer-reviewed academic paper.