16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
A guest virtual machine can cause a use-after-free problem in Linux's KVM hypervisor, corrupting the host kernel's shadow-page data.
The vulnerability, known as "Januscape" and tracked as CVE-2026-53359, is found in the shadow MMU code that KVM shares with AMD and Intel. The researcher believes that a different, undisclosed attack translates the same problem into full host code execution, while the public proof-of-concept frightens the host.
The flaw was discovered and reported by security researcher Hyunwoo Kim (@v4bel). To the best of the public's knowledge, he said, Januscape is the first guest-to-host attack that can be triggered on both AMD and Intel. The defect was ignored for about sixteen years.
Kim claims that Google's kvmCTF, a controlled KVM vulnerability reward progra...