Januscape KVM/x86 Flaw Enables Guest-to-Host Escape and Root Escalation

A long-standing flaw in Linux KVM/x86 shadow paging, tracked as CVE-2026-53359 and dubbed Januscape, can let a guest corrupt host kernel memory and potentially escape isolation. The bug is a use-after-free in KVM shadow MMU emulation caused by incomplete cleanup logic that left stale references to freed page-table tracking structures; reporting indicates earlier validation checked only the guest frame number and not the page role. The issue affects both Intel and AMD hosts, has reportedly existed since Linux kernel 2.6.36, and was disclosed as a vulnerability that can be triggered solely through guest-side actions.