Two high-severity vulnerabilities affecting the Linux kernel were disclosed this week, each representing significant security risks to systems running affected versions.
The first vulnerability, designated CVE-2026-53359 and named Januscape, exists within KVM, a virtualization application integrated into the Linux kernel used by numerous distributions. This flaw enables untrusted guest virtual machines to break out of their isolated containers and compromise host machines, affecting systems running both AMD and Intel processors. According to researcher Hyunwoo Kim, who discovered the vulnerability, an attacker with access to a single cloud instance could potentially shut down other tenant VMs on the same physical server or execute code with root privileges on the host system. The vulnerability stems from a use-after-free memory corruption issue in the shadow MMU emulation process, which handles memory address translation between guest and host systems. Remarkably, the flaw remained undetected for 16 years. Kim demonstrated the vulnerability through a proof-of-concept exploit that triggers a host system crash, though a full escape exploit exists but will not be publicly released in the near future. Google’s kernelCTF bug-bounty program awarded $250,000 for the discovery and reporting of this vulnerability.
A second critical flaw, tracked as CVE-2026-43499, allows users with limited system privileges to escalate their access to root level. Researchers at Nebula Security identified this vulnerability, which was present in the Linux kernel for 15 years. The flaw resides in the kernel’s futex priority-inheritance system, which manages task scheduling to prevent urgent processes from being blocked by lower-priority ones. A use-after-free condition occurs in a specific code path where lock operations fail and must be rolled back, causing cleanup to execute at an incorrect time and reference freed memory. The vulnerability carries a severity rating of 7.8 out of 10. Nebula named this flaw GhostLock and received $92,337 through Google’s kernelCTF program.
Both vulnerabilities have been patched in the Linux kernel. Users are advised to verify that updates have been applied to their specific Linux distribution.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI