● Covered by 5 sources · 5 reportsMedium impact
Critical KVM/x86 Vulnerability Allows VM Escape to Host on Intel and AMD
Key points
- CVE-2026-53359 allows VM escape on KVM/x86.
- Impacts Intel and AMD systems in multi-tenant clouds.
- Found by Hyunwoo Kim, exploited as zero-day.
- Google kvmCTF awarded $250,000 for discovery.
- Unnoticed for 16 years, patched in June 2026.
Overview of Januscape Vulnerability
A 16-year-old Linux kernel vulnerability known as Januscape (CVE-2026-53359) has been identified, allowing virtual machines (VMs) running under the KVM hypervisor to escape and execute code on the host system. This use-after-free flaw affects both Intel and AMD architectures and represents a significant risk for multi-tenant public cloud environments.
Discovery and Exploitation
Hyunwoo Kim, a security researcher, discovered and reported Januscape. The vulnerability was successfully demonstrated in Google's kvmCTF, a competitive bug bounty program that offers up to $250,000 for guest-to-host escapes. Kim's research indicates this is the first such exploit that works across both major processor architectures.
Technical Details
Januscape exploits a flaw in the shadow memory management unit (MMU) emulation within the KVM hypervisor. The bug allows an attacker with root access from a guest VM to corrupt the host's shadow-page state, potentially leading to full host compromise or denial-of-service attacks.
Implications for Cloud Service Providers
The vulnerability represents a serious threat to cloud service providers such as Google Cloud and AWS. Since many cloud instances involve running potentially untrusted guest VMs, the risk of an exploit like Januscape is considerable. Compromised security could lead to breaches affecting multiple tenants on the same host.
Conclusion
Although unnoticed for 16 years, Januscape serves as a reminder of the importance of vigilance and ongoing security assessments in virtualized environments. A patch is now available as of June 2026, and both cloud providers and users are urged to apply it promptly to mitigate potential risks.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cmc_internal/api GitHub github/collect GitHub V4bel/Januscape GitHub _private/browser GitHub get-started/accessibility GitHub search-github/github-code-searchHow outlets covered it
Google has rewarded $250K for the discovery of a critical Linux vulnerability, CVE-2026-53359, in KVM that allows untrusted virtual machines to gain root access to host machines. Known as Januscape, this flaw poses a significant risk to cloud platforms, potentially enabling attackers to compromise the host environment and affect other tenants.
A 16-year-old Linux kernel vulnerability, termed Januscape (CVE-2026-53359), allows VM escape and arbitrary code execution on host environments. This flaw affects both Intel and AMD architectures, posing significant risks to multi-tenant public cloud setups.
A critical Linux kernel vulnerability, tracked as CVE-2026-53359, allows code execution on the host from a guest VM, impacting KVM hypervisor on Intel and AMD systems. The flaw poses significant risks for multi-tenant cloud environments and could enable attackers to escalate privileges or cause denial-of-service attacks.
A use-after-free vulnerability in Linux's KVM hypervisor, tracked as CVE-2026-53359, allows guest virtual machines to potentially execute arbitrary code on the host. Previously undetected for 16 years, this flaw poses significant risks for cloud service providers and virtualized environments as it can lead to host-system compromise through mismanaged memory access.
The Januscape vulnerability (CVE-2026-53359) enables a guest VM to escape to the host in KVM/x86 environments. This use-after-free flaw poses significant risks to host-guest isolation, particularly in multi-tenant public clouds like Google Cloud and AWS, and has been successfully exploited in a demonstration.