A critical vulnerability in KVM, a virtual machine component embedded in the Linux kernel, was disclosed this week, enabling untrusted guest virtual machines to break out of isolation and obtain root-level access to host systems. Designated CVE-2026-53359 and named Januscape, the flaw affects KVM implementations on both AMD and Intel processors. The vulnerability stems from a use-after-free memory corruption issue in the shadow MMU emulation process, which handles memory address translation between host and hypervisor systems. Researcher Hyunwoo Kim, who identified the vulnerability, noted that attackers exploiting this flaw could launch denial-of-service attacks against other tenants on shared physical infrastructure or execute arbitrary code with elevated privileges on the host system.
The vulnerability remained undetected in the Linux kernel for 16 years. A proof-of-concept exploit has been released that triggers host-side crashes, though a full guest escape exploit exists but will not be made public for an extended period. The flaw does not manifest in QEMU, a related memory translation process, meaning it can function in cloud environments using custom virtualization stacks. Successful exploitation requires the guest virtual machine user to possess root privileges. Google recognized the discovery through its kernelCTF bug-bounty program, awarding $250,000 for reporting the issue.
Separately, a second Linux kernel vulnerability surfaced this week, tracked as CVE-2026-43499 and called GhostLock. Discovered by Nebula Security researchers using their Vega AI-assisted vulnerability scanner, this flaw resides in the kernel’s futex priority-inheritance machinery and allows users with limited system rights to escalate privileges to root level. The use-after-free vulnerability persisted in the Linux kernel for 15 years, originating from code written in 2011. GhostLock carries a severity rating of 7.8 out of 10, and Google awarded the discovering researchers $92,337 through the same kernelCTF program.
Both vulnerabilities have received kernel patches. Linux distribution users are advised to verify that security updates addressing these flaws have been applied to their respective systems.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI