There’s a pretty grisly CVE making the rounds. It’s being marketed as Januscape (CVE-2026-53359).
It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment. To the best of public knowledge, this is the first guest-to-host exploit research triggerable on both Intel and AMD rather than being limited to a single architecture.
Januscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86. It can trigger the bug with guest-side actions alone to corrupt the host kernel’s shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds (GCP, AWS, etc.).
What this means is that if you have a VM, you can jump out of the VM and get panic the host kernel. The author states there are other possible endgames – presumably getting root.
Note that nested virtualization – it’s really important. Not all providers enable that. Nested virtualization is a feature that can be turned on by providers which allows guests to virtualize. So for example, you get a VPS from ExampleHost. Then on your VPS, you use Linux KVM to create some more VMs. They’re dog slow, but it does work. However, a lot of providers don’t enable the functionality.
I suspect there will be mass patching at a lot of providers in the next 24 hours, possibly proceeded by scripts to turn off nested virt on all guests.
BTW, the code that is exploited has been in the kernel since 2010:
The vulnerable code has been present since commit 2032a93d66fa in August 2010 (kernel 2.6.36 era) and was fixed by commit 81ccda30b4e8, merged into mainline on June 19, 2026.
Related Posts:
raindog308 is a longtime community LETizen, technical writer, and self-described techno polymath. With deep roots in the *nix world, he has a passion for systems both modern and vintage, ranging from Unix, Perl, Python, and Golang to shell scripting and mainframe-era operating systems like MVS. He’s equally comfortable with relational database systems, having spent years working with Oracle, PostgreSQL, and MySQL.
As an avid user of LowEndBox providers, raindog308 runs an empire of LEBs, from tiny boxes for VPNs, to mid-sized instances for application hosting, and heavyweight servers for data storage and complex databases. He brings both technical rigor and real-world experience to every piece he writes.
Beyond the command line, raindog308 has a life-long love of German Shepherd Dogs, high-quality knives, target shooting, theology, tabletop RPGs, playing guitar, and hiking in deep, quiet forests.
His goal with every article is to help users, from beginners to seasoned sysadmins, get more value, performance, and enjoyment out of their infrastructure.
You can find him daily in the forums at LowEndTalk under the handle @raindog308.
Leave a Reply