New Januscape Linux flaw allows VM escape on Intel, AMD devices

A critical 16-year-old Linux kernel vulnerability named Januscape (CVE-2026-53359) enables guest-to-host virtual machine escape on both Intel and AMD architectures, posing significant risks to multi-tenant cloud environments. The flaw resides in KVM/x86's shadow MMU emulation and can be exploited by attackers with root access inside a guest VM to execute arbitrary code on the host or cause a denial-of-service by crashing the host kernel. It was used as a zero-day in Google's kvmCTF program, and when combined with the Dirty Frag privilege escalation, even unprivileged attackers could achieve full compromise. Administrators are urged to apply patch commit 81ccda30b4e8 to mitigate exposure.

AI-extracted · verify before operational use