Januscape: 16-year-old Linux KVM flaw lets guest VMs escape to host on Intel and AMD

A critical vulnerability in the Linux kernel's KVM hypervisor, tracked as CVE-2026-53359 and named Januscape, allows a malicious virtual machine guest to break out of its sandbox and corrupt memory on the host system. The flaw has existed since August 2010 — 16 years — and affects both Intel and AMD systems through shared x86 KVM code. Patches for the bug were distributed on July 4, 2026 in stable kernel releases.

What the bug does

Januscape lives in KVM's shadow MMU, the software component that handles nested virtualization — the case where a virtual machine runs its own hypervisor to host further guest VMs. When this occurs, the host kernel (L0) must emulate a second layer of address translation in software using shadow page tables. The vulnerability arises because KVM incorrectly reuses an existing shadow page based solely on a matching guest frame number, without verifying the page's role. This mismatch causes use-after-free conditions: freed shadow pages remain referenced, corrupting kernel memory. As reported by CyberSecurity News, a public proof-of-concept already triggers a host kernel panic; the researcher claims a separate, unreleased exploit converts this into full host code execution.

Why this matters for cloud infrastructure

The real-world risk is concentrated in multi-tenant cloud environments. To exploit Januscape, an attacker needs root access inside a VM and must have nested virtualization exposed by the host — conditions that are common on rented cloud instances where tenants regularly run their own hypervisors. A successful attack would let one cloud tenant escape their virtual machine entirely and execute arbitrary code on the physical host, potentially reaching other tenants' workloads. Januscape is notable as the first known guest-to-host exploit that works across both Intel VMX and AMD SVM architectures.

Patch and mitigation

Fixed stable kernel versions shipped July 4: 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, and 5.10.260. The fix ensures shadow pages are only reused when both the guest frame number and the page role match, eliminating the root cause of the type confusion. Organizations that cannot patch immediately can remove the attack surface by disabling nested virtualization: set kvm_intel.nested=0 on Intel hosts or kvm_amd.nested=0 on AMD hosts. The bug was first disclosed as a zero-day submission in Google's kvmCTF program, which offers up to $250,000 for full guest-to-host escapes.

Timeline

The flaw traces to commit 2032a93d66fa from August 2010, introduced during the kernel 2.6.36 development cycle. It went undetected through 16 years of Linux kernel development, security audits, and fuzz testing before being discovered and privately reported through Google's kvmCTF in June 2026. The CVE was assigned and patches were prepared and merged over the following weeks, with stable backports landing on July 4.