16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
Summary: A use-after-free bug in Linux's KVM shadow MMU code, tracked as CVE-2026-53359 and named Januscape, lets a guest VM corrupt the host kernel's shadow-page state on both Intel and AMD x86 systems; researcher Hyunwoo Kim reported it and said it went unnoticed for roughly 16 years, since commit 2032a93d66fa in August 2010. The public proof-of-concept panics the host, while Kim claims a separate, unreleased exploit achieves full host code execution, and the fix (commit 81ccda30b4e8, a one-line addition to kvm_mmu_get_child_sp() by maintainer Paolo Bonzini) was merged into mainline on June 19, 2026 and shipped in stable kernels on July 4, 2026.
Key Takeaway: The attack needs only root inside a rented VM plus nested virtualization exposed by the host, so an attacker holding a single cloud instance can panic the physical machine and take down every other tenant VM on it, or, per Kim's withheld exploit, run code as root on the host. NVD had not assigned a CVSS score at the time of writing, but SUSE rated it 8.8 (v3.1) and 9.3 (v4.0).
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-43284CVE-2026-43500CVE-2026-46316CVE-2026-53359
- Related