New Januscape Linux flaw allows VM escape on Intel, AMD devices

Januscape (CVE-2026-53359) is a 16-year-old Linux kernel vulnerability stemming from a use-after-free weakness in the shadow MMU emulation of KVM/x86, the kernel-based virtual machine for x86 and x86_64 (AMD64) architectures. It allows a guest-to-host VM escape, enabling attackers with root access inside a guest virtual machine to execute arbitrary code as root on the host, take over all other guest VMs on the same physical host, or crash the host kernel (denial of service). It is notable as the first guest-to-host exploit triggerable on both Intel and AMD processor architectures. On Linux distributions where /dev/kvm is world-writable (e.g., RHEL), unprivileged attackers can exploit it to gain root privileges. The flaw was used as a zero-day in Google's kvmCTF vulnerability reward program. A proof-of-concept exploit capable of triggering host kernel panic has been published; a full guest-to-host escape exploit has not been released. Chaining with the Dirty Frag flaw (CVE-2026-43284, CVE-2026-43500) allows attackers without initial guest root access to achieve full host compromise.