A devastating Linux kernel vulnerability has been discovered, allowing attackers to escape virtual machines and execute code on the host with root privileges. Dubbed Januscape, this critical flaw affects both Intel and AMD processor architectures, posing a significant risk to multi-tenant public cloud environments.
Januscape stems from a 16-year-old weakness in the shadow MMU emulation of KVM/x86, a kernel-based virtual machine built for x86 and x86_64 (AMD64) processor architectures. The vulnerability allows attackers with root access inside a guest virtual machine to execute code as root on the host, effectively taking control of all guests running on it or crashing the host kernel.
This means that an attacker can compromise not only their own virtual machine but also potentially disrupt services for other tenants sharing the same physical server. According to Hyunwoo Kim, the security researcher who discovered Januscape, “an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE).”
The vulnerability was used as a zero-day exploit in Google’s kvmCTF vulnerability reward program, and it has been present in the Linux kernel for approximately 16 years before being patched in June. The fact that Januscape can be triggered on both Intel and AMD architectures is particularly concerning, as this makes it more difficult to mitigate.
The risk of Januscape is compounded by the existence of other vulnerabilities that can be chained together to achieve full compromise. In May, Kim disclosed a Linux local privilege escalation flaw called Dirty Frag, which can be used in conjunction with Januscape to gain root access on major distributions.
Administrators running KVM/x86 hosts that accept multi-tenant guests should confirm that patch commit 81ccda30b4e8 has been applied to the host kernel to ensure their systems are secure against attacks. This is a critical step, as unpatched devices can be exploited by attackers with even limited privileges.
In light of this vulnerability, it’s essential for security teams to remain vigilant and regularly test their defenses to prevent similar breaches in the future. By staying informed about emerging threats and taking proactive measures to patch vulnerabilities, organizations can reduce the risk of cyber attacks and protect sensitive data from unauthorized access.
Source: Bleeping Computer — 2026-07-07