A high-severity vulnerability in the Linux kernel’s KVM virtualization component has been disclosed this week, prompting a significant bounty from Google. The flaw, designated CVE-2026-53359 and named Januscape, resides in KVM guest-side code and allows untrusted virtual machines to break out of isolation and gain root-level access to the underlying host system. The vulnerability affects KVM implementations on both AMD and Intel processors and remained undetected in the Linux kernel for 16 years.
Researcher Hyunwoo Kim discovered the flaw, which is classified as a use-after-free memory corruption vulnerability occurring in the shadow MMU emulation process. This component handles address translation between host and hypervisor memory spaces. According to Kim’s analysis, an attacker with access to a single cloud instance could leverage the vulnerability to crash the host kernel and disrupt other tenant virtual machines, or execute code with root privileges to compromise the entire host system and all guest instances running on it. Kim has released a proof-of-concept exploit demonstrating a host crash triggered from within a guest VM, though a full escape exploit exists but will not be released in the near term.
A second high-severity vulnerability also surfaced during this period, tracked as CVE-2026-43499 and named GhostLock. This flaw allows users with limited system rights to escalate privileges to root level and remained in the Linux kernel for 15 years. Researchers from Nebula Security identified the vulnerability using the company’s AI-assisted vulnerability scanner called Vega. The issue resides in the kernel’s futex priority-inheritance system, a mechanism designed to prevent urgent tasks from being delayed by lower-priority operations. A cleanup procedure executes at an incorrect moment in a rare code path, leaving the kernel holding a stale pointer to freed memory, which attackers can exploit to gain root access.
Google’s kernelCTF bug-bounty program awarded $250,000 for the discovery of Januscape and $92,337 for GhostLock. Both vulnerabilities have received kernel patches, and Linux users are advised to verify that fixes have been applied to their particular distribution.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI