Januscape Linux Kernel Flaw Enables KVM VM Escape on Intel and AMD
Summary
CVE-2026-53359 is a 16-year-old KVM/x86 use-after-free that can let attackers escape a Linux guest to the host. A kernel patch was applied in June 2026; administrators should verify commit 81ccda30b4e8.
Key points
- Januscape (CVE-2026-53359) is a use-after-free in KVM/x86 shadow MMU emulation.
- The flaw can affect Intel and AMD hosts and was present in the Linux kernel for about 16 years before being patched in June 2026.
- An attacker with root access inside a guest may execute code as root on the host or crash the host kernel, affecting other guest VMs.
- The article says the flaw was used as a zero-day in Google's kvmCTF vulnerability reward program.
- On some distributions where /dev/kvm is world-writable, unprivileged attackers may also exploit the flaw to gain root on unpatched devices.
- Researcher Hyunwoo Kim published a technical write-up and a proof of concept that can trigger a host kernel panic; he said a full guest-to-host escape exploit would not be released for the foreseeable future.
- Administrators of KVM/x86 hosts should verify that patch commit 81ccda30b4e8 is applied. Kim also said Dirty Frag can be chained with Januscape for full compromise.
Article Details
- Vulnerability Types
- Use-after-free
- Guest-to-host virtual machine escape
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationExploitation of CVE-2026-53359 can let an attacker escape a guest VM and execute code with root privileges on the host.T1499.004 · Application or System ExploitationThe article says exploitation can panic the host kernel, taking other tenant VMs on that physical machine offline.
CVE
CVE-2026-432842026, Kim also disclosed Dirty Frag, a Linux local privilege escalation flaw that chains xfrm-ESP (CVE-2026-43284) and RxRPC (CVE-2026-43500) page-cache write vulnerabilities to gain root access on majorCVE-2026-43500Dirty Frag, a Linux local privilege escalation flaw that chains xfrm-ESP (CVE-2026-43284) and RxRPC (CVE-2026-43500) page-cache write vulnerabilities to gain root access on major distributions, including Ubuntu, RedCVE-2026-53359Januscape is a 16-year-old Linux kernel vulnerability, tracked as CVE-2026-53359, that lets attackers escape a KVM virtual machine and execute code as root on the host.
People
Vendors
Amazon Web Servicesdistinct risk to multi-tenant public cloud environments, such as those offered by Google Cloud and Amazon Web Services.GoogleJanuscape has been present in the Linux kernel for approximately 16 years before being patched in June 2026, and was used as a zero-day exploit in Google’s kvmCTF vulnerability reward program (VRP).Red HatOn some Linux distros, such as Red Hat Enterprise Linux (RHEL), where /dev/kvm is world-writable, unprivileged attackers can also exploit CVE-2026-53359 to reliably gain root permissions on unpatched devices.
Products
CentOS Streamto gain root access on major distributions, including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, and Fedora.Fedoragain root access on major distributions, including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, and Fedora.Google Cloudthat it poses a distinct risk to multi-tenant public cloud environments, such as those offered by Google Cloud and Amazon Web Services.KVMJanuscape is a 16-year-old Linux kernel vulnerability, tracked as CVE-2026-53359, that lets attackers escape a KVM virtual machine and execute code as root on the host.LinuxJanuscape is a 16-year-old Linux kernel vulnerability, tracked as CVE-2026-53359, that lets attackers escape a KVM virtual machine and execute code as root on the host.Red Hat Enterprise LinuxOn some Linux distros, such as Red Hat Enterprise Linux (RHEL), where /dev/kvm is world-writable, unprivileged attackers can also exploit CVE-2026-53359 to reliably gain root permissions on unpatched devices.Ubuntu(CVE-2026-43500) page-cache write vulnerabilities to gain root access on major distributions, including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, and Fedora.