16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
Summary
A 16-year-old use-after-free vulnerability in Linux's KVM hypervisor, named 'Januscape' and tracked as CVE-2026-53359, allows guest virtual machines to escape to the host on Intel and AMD x86 systems. This flaw corrupts the shadow-page state of the host kernel, and a public proof-of-concept can cause a host panic.
IFF Assessment
FOE
This vulnerability allows a guest VM to potentially gain control over the host system, which is a severe threat to defenders.
Severity
8.8
High
Defender Context
This 'Januscape' vulnerability in Linux KVM is a critical concern for any organization running virtualized environments on Intel or AMD processors. Defenders must prioritize patching and monitoring for any signs of exploitation, as a guest VM escape can lead to complete host compromise.