A crucial vulnerability within the Kernel-based Digital Machine (KVM) module of the Linux kernel permits attackers with root entry in a visitor VM to execute arbitrary code on the host system. This violates crucial safety boundary that cloud suppliers and enterprises depend on to isolate delicate processes on servers.
The vulnerability, tracked as CVE-2026-53359, stems from a use-after-free reminiscence bug within the shadow MMU emulation of KVM on x86 CPU structure. Based on Hyunwoo Kim, the researcher who found it, the flaw has been current within the Linux kernel code for the previous 16 years and is the primary KVM guest-to-host escape vulnerability that works on each Intel and AMD CPUs.
Hyunwoo dubbed the flaw Januscape and reported it by Google’s kvmCTF, a vulnerability reward program that pays as much as $250,000 for a full VM escape demonstrated in KVM, which Google makes use of in Google Cloud in addition to Android infrastructure.
