This bug sat inside the Linux hypervisor for sixteen years before anyone found it
It works against both Intel and AMD.
CVE-2026-53359 — "Januscape." A use-after-free in the shadow MMU code that KVM shares across x86 vendors, letting a malicious guest VM with root privileges escape to the host. It is the first publicly known guest-to-host exploit path that works on both Intel and AMD silicon.
WHAT ACTUALLY HAPPENED
When a guest modifies a page-directory entry and then deletes the associated memory slot, KVM's cleanup routine is supposed to tear down every reverse-mapped shadow page entry tied to it. Januscape hits the case where the entry now points to a non-leaf page — the guest frame number still matches, so KVM's reuse check hands back a page that has already been freed. The cleanup routine then writes to that freed memory.
The public proof-of-concept crashes the host. The researcher who found it says a separate, unreleased exploit turns the same bug into full host code execution. Closing the window completely requires two coupled patches, CVE-2026-53359 and CVE-2026-46113, which shipped July 4 across stable kernel branches back to 5.10.
WHY SIXTEEN YEARS MATTERS MORE THAN THE CVSS SCORE
Every multi-tenant cloud environment runs on the assumption that a hypervisor boundary is a hard boundary. That assumption held here for sixteen years of production use — not because the code was safe, but because nobody had looked closely enough at this exact race condition. Code age is not evidence of code safety. It is evidence that this particular path hasn't been tested yet.
WHAT TO DO NOW
APPLY BOTH CVE-2026-53359 AND CVE-2026-46113 — patching one without the other leaves the escape path partially open.
- CHECK YOUR KERNEL AGAINST THE FIXED VERSIONS 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, 5.10.260. If you're below your branch's fixed point, you're exposed.
DISABLE NESTED VIRTUALIZATION IF YOU CANNOT PATCH NOW — kvm_intel.nested=0 or kvm_amd.nested=0 removes the attack path for untrusted guest workloads immediately.
TREAT ANY HOST RUNNING UNTRUSTED TENANT WORKLOADS AS PRIORITY ONE — shared hosting, CI runners, and multi-tenant Kubernetes nodes on KVM carry the highest exposure to this specific bug.
A hypervisor escape bug that predates most of your infrastructure team is still a hypervisor escape bug today. Age bought it silence, not safety.
When did you last audit which of your hosts run untrusted guest workloads on KVM without nested virtualization restrictions?