16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

A critical 16-year-old use-after-free vulnerability in Linux's KVM hypervisor, dubbed 'Januscape' and tracked as CVE-2026-53359, allows guest virtual machines to escape to the host on both Intel and AMD x86 systems. The flaw resides in the shadow MMU code and can lead to host kernel corruption or full host code execution when exploited. The vulnerability affects any x86 environment hosting untrusted guests with nested virtualization enabled, posing a high risk to multi-tenant cloud environments.

AI-extracted · verify before operational use