Ubuntu Warns Januscape KVM Flaw Could Let Guests Compromise Hypervisor Hosts

Ubuntu disclosed mitigation guidance for CVE-2026-53359 ("Januscape"), a Linux kernel local privilege escalation flaw affecting nested virtualization in KVM on Intel and AMD x86_64 systems. The issue impacts Ubuntu releases from 14.04 through 26.04, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the hypervisor kernel, while unprivileged containers are not affected; however, privileged containers and systems exposing /dev/kvm to non-privileged users may face elevated risk.

Canonical's Ubuntu CVE tracker lists CVE-2026-53359 among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including linux, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, and linux-hwe-5.11, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including CVE-2026-46331, a pedit subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and CVE-2026-52951, a drm/xe/dma-buf use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.