MEDIUMVulnerability
Global

16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

·Source: The Hacker News

Updated:

Executive Summary

A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD. The public proof-of-concept panics the host; the researcher claims that a separate, unreleased exploit

Analysis

A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD. The public proof-of-concept panics the host; the researcher claims that a separate, unreleased exploit

Indicators of Compromise (1)

CVE (1)
CVE-2026-53359
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jul 6, 2026.

Related Threats

LOWZero Day

VMs won't contain cyber-capable agents

<p>As part of <a href="https://trailofbits.com/patch-the-planet">Patch the Planet</a>, we received preview access to <a href="https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/">GPT 5.6-Cyber</a> with a simple task: evaluate its cyber capabilities. <a href="https://openai.com/index/hugging-face-model-evaluation-security-incident/">Recent events</a> inspired me to give

CVE-2026-53359CVE-2026-9539
Trail of Bits
CRITICALZero Day

17 old software bugs that took way too long to squash

In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old — and there was no patch available, and no expectation that one would be forthcoming. Fortunately, that’s because the system in question was Marvin Minsky’s 1967 implementation of a Un

CVE-2026-25646CVE-2026-42945
CSO Online
CRITICALApt

16-year-old KVM flaw allows attackers to escape VMs and take over Linux servers

A critical vulnerability in the Kernel-based Virtual Machine (KVM) module of the Linux kernel allows attackers with root access in a guest VM to execute arbitrary code on the host system. This violates the most important security boundary that cloud providers and enterprises rely on to isolate sensitive processes on servers. The vulnerability, tracked as CVE-2026-53359 , stems from a use-after-fre

CVE-2026-53359CVE-2026-46316
CSO Online