A newly disclosed Linux kernel vulnerability has left multi-tenant x86 public clouds vulnerable to a major security threat. Tracked as CVE-2026-53359, the flaw allows attackers to escape virtual machines (VMs) and execute code on the underlying host, posing a significant risk to cloud providers and their customers.
The vulnerability, known as Januscape, affects the shadow MMU code in Linux Kernel-based Virtual Machine (KVM) hypervisor. This is particularly concerning because it can be triggered on both Intel and AMD architectures, making it a universal threat to public clouds running untrusted guests and exposing nested virtualization. The flaw was discovered by security researcher Hyunwoo Kim, who demonstrated its potential as a zero-day exploit in Google’s kvmCTF bug bounty program.
Januscape works by exploiting a use-after-free vulnerability that can be triggered from the VM to corrupt the shadow page state of the host’s kernel. Successful exploitation can lead to a full compromise of the host on which the VM is running, allowing attackers to execute code with root privilege or even take control of the entire physical machine.
According to Kim, an attacker could potentially use this vulnerability to panic the host kernel and take down every other tenant VM on the same physical machine (denial-of-service, or DoS), or run code with root privilege on the host to gain complete control over the host and all its guests. On certain Linux distributions, such as Red Hat Enterprise Linux (RHEL), the vulnerability can even be exploited by unprivileged users to escalate their privileges to root.
While Januscape requires root privileges on the guest machine, which is typically available by default when a user is allocated a VM instance on a public cloud, an attacker could chain this flaw with a privilege escalation bug to gain access. For example, Kim mentions that Dirty Frag, another known vulnerability, could be used in conjunction with Januscape.
The good news is that CVE-2026-53359 has been patched in the mainline Linux kernel since June 19th, when commit 81ccda30b4e8 was merged. This means that cloud providers and users who have updated their systems should be protected from this vulnerability. However, it’s essential to note that Januscape had been dormant in the Linux kernel for 16 years before being discovered, highlighting the importance of regular security audits and updates.
As a practical takeaway, we recommend that all cloud users and administrators ensure they are running patched versions of their Linux distributions, particularly if they are using KVM-based virtualization. Additionally, it’s crucial to regularly review and update your systems to prevent similar vulnerabilities from going undetected for years.
Source: SecurityWeek — 2026-07-07