Bottom line: CVE-2026-53359 enables VM escape on Intel and AMD processors and endangers multi-tenant cloud environments through privileged host takeover.
A memory error in the Linux KVM hypervisor allows attackers with root access in a virtual machine to take over the physical host – a flaw that lay undiscovered in the code for 16 years.
In the KVM hypervisor (Kernel-based Virtual Machine) of the Linux kernel, there is a use-after-free error in the shadow MMU component under the CVE ID CVE-2026-53359. The flaw is designated Januscape. Security researchers describe it as the first known KVM vulnerability that works on both major x86 platforms – on both Intel and AMD processors. The vulnerability was discovered by security researcher Hyunwoo Kim (@v4bel) as part of kvmCTF, Google’s bug bounty program in the format of a capture-the-flag competition. Google pays up to $250,000 for complete VM escapes.
Technically, the error allows an attacker with root access in the guest VM to manipulate and corrupt the state of shadow pages in the host system’s kernel. The impact ranges from denial of service – crashing the host kernel, which also takes all other VMs on the same hardware offline – to executing malicious code with root privileges on the host itself. In the latter case, both the host and all running virtual machines are compromised.
Multi-tenant cloud environments in which multiple customers run untrusted guest systems on shared hardware are particularly vulnerable, as are configurations with nested virtualization. On some distributions like Red Hat Enterprise Linux, the vulnerability can also enable privilege escalation to root for regular users without special privileges. To exploit Januscape, the attacker first needs root access in their VM – a situation that is typically the default state at cloud providers. If that is not the case, according to Kim, the additional vulnerability Dirty Frag can be used for privilege escalation.
The faulty code remained undetected in the kernel for approximately 16 years. The vulnerability was fixed on June 19 via commit 81ccda30b4e8, which was merged into the mainline branch.
Source: www.it-daily.net · Published July 8, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 of the EU AI Act. Paraphrasing and classification via Lumi News Pipeline v1.7.3.