A critical vulnerability in KVM, the virtual machine component built into many Linux distributions, has surfaced allowing untrusted guest instances to break free from their isolated containers and gain root-level access to underlying host systems. Identified as CVE-2026-53359 and named Januscape, the flaw affects KVM deployments running on both AMD and Intel processors. Researcher Hyunwoo Kim, who discovered the vulnerability, noted that it remained undetected for 16 years despite residing in guest-side code rather than host resources.
The vulnerability represents a use-after-free memory corruption weakness in the shadow MMU emulation process, which handles address translation between host and hypervisor memory spaces. An attacker with access to a single virtual machine instance could exploit this to either disable all other tenant instances on the same physical machine or execute code with root privileges to commandeer the host and all its guest systems. Kim has released a proof-of-concept demonstrating how guest-side actions alone can crash the host kernel, though he is withholding a more complete escape exploit for future release. The flaw notably functions even in cloud environments using proprietary virtualization stacks, as it does not depend on QEMU functionality.
A second significant Linux kernel vulnerability, tracked as CVE-2026-43499 and dubbed GhostLock, was simultaneously disclosed. This flaw allows users with limited system privileges to escalate to root access and hid in the kernel for 15 years. Nebula Security researchers discovered it using Vega, an AI-assisted vulnerability scanner, identifying a use-after-free condition in the futex priority-inheritance mechanism. The defect causes cleanup operations to execute at incorrect timing, leaving the kernel referencing freed memory. Nebula researchers demonstrated chaining multiple steps from this weakness to achieve full root-level control.
Google has awarded $250,000 through its kernelCTF bug-bounty program for disclosure of the Januscape vulnerability and $92,337 for the GhostLock discovery. Both vulnerabilities have received kernel patches, and Linux users are advised to verify that fixes have been deployed to their respective distributions.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI