Multiple outlets report on a long-dormant Linux kernel vulnerability affecting the KVM hypervisor, dubbed “Januscape.” The flaw is described as a use-after-free issue that attackers can trigger from within a guest virtual machine. When exploited, the bug can allow VM escape, potentially letting an attacker execute arbitrary code on the underlying host system by corrupting state associated with KVM’s shadow memory management.
Sources state the vulnerability resides in KVM’s shadow MMU/shadow page handling code, and that it applies to Intel and AMD x86 systems. One report notes the bug traces back to changes made in Linux kernel 2.6.36 (August 2010), implying it has persisted for roughly 16 years. The issue is tracked as CVE-2026-53359.
Public proof-of-concept material reportedly causes host crashes (panic), while at least one source indicates a separate, unreleased exploit may exist but has not been publicly provided. Overall, the coverage emphasizes the risk to cloud and virtualized environments where KVM-based isolation is expected.
