Two significant vulnerabilities in the Linux operating system came to light this week, both enabling unprivileged users to escalate to root access through different attack vectors.
The first vulnerability, designated CVE-2026-53359 and named Januscape, exists within KVM, a virtualization system embedded in the Linux kernel. The flaw permits untrusted guest virtual machines running on both AMD and Intel processors to break out of their isolated containers and compromise the underlying host system. The use-after-free vulnerability affects the shadow MMU emulation process, which handles memory address translation between host and hypervisor systems. According to researcher Hyunwoo Kim, who discovered the flaw, attackers with access to a single cloud instance could exploit guest-side actions to corrupt the host kernel’s shadow page structure. The potential consequences range from denying service to all other tenant VMs on the same physical hardware to executing code with root-level privileges across the entire system. Kim noted that while a proof-of-concept exploit demonstrating host crashes has been released, a full guest escape exploit exists but will remain undisclosed for the foreseeable future. Notably, the vulnerability functions independently of QEMU and other separate virtualization components, meaning it can succeed even in cloud environments using custom virtualization stacks. Google’s vulnerability disclosure program provided a $250,000 bounty for reporting this flaw, which had remained undetected for 16 years.
A separate vulnerability tracked as CVE-2026-43499, termed GhostLock, was discovered by researchers at Nebula Security using an AI-assisted vulnerability scanning tool called Vega. This flaw resides in the kernel’s futex priority-inheritance system, which manages task scheduling to prevent high-priority operations from being blocked by lower-priority ones. The vulnerability stems from a use-after-free condition in a cleanup routine that occasionally executes at an incorrect moment, leaving the kernel with a reference to already-freed memory. Nebula Security researchers successfully chained multiple exploitation steps to convert this memory corruption issue into full root-level code execution. The vulnerability, which has existed since 2011 within old and heavily-used kernel machinery, carries a severity rating of 7.8 out of 10. Google awarded $92,337 through its kernelCTF bug-bounty program for this disclosure.
Both vulnerabilities have received patches in the Linux kernel. Distribution maintainers and users are advised to verify that the necessary security updates have been applied to their respective Linux installations.
Originally reported by Ars Technica. Read the full story →