Loading story…
Ubuntu disclosed mitigation guidance for CVE-2026-53359 ("Januscape"), a Linux kernel local privilege escalation flaw affecting nested virtualization in KVM on Intel and AMD x86_64 systems. The issue impacts Ubuntu releases from 14.04 through 26.04, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the hypervisor kernel, while unprivileged containers are not affected; however, privileged containers and systems exposing /dev/kvm to non-privileged users may face elevated risk.
Canonical's Ubuntu CVE tracker lists CVE-2026-53359 among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including linux, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, and linux-hwe-5.11, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including CVE-2026-46331, a pedit subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and CVE-2026-52951, a drm/xe/dma-buf use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Ubuntu published guidance for CVE-2026-53359 on July 11, 2026, stating fixes were still pending and recommending disabling nested virtualization as a temporary mitigation. The notice warned that privileged containers and systems exposing /dev/kvm to non-privileged users may be at risk, while unprivileged containers were not a concern.
Ubuntu said the local privilege escalation flaw CVE-2026-53359, dubbed Januscape, was publicly disclosed on July 6, 2026. The bug affects nested virtualization in KVM on Intel and AMD x86_64 systems, and a proof-of-concept showed a guest could crash a hypervisor host.
Linux released security updates on June 28, 2026 to address multiple kernel vulnerabilities that could lead to denial of service, privilege escalation, information disclosure, data manipulation, security bypass, or arbitrary code execution. The notice specifically highlighted CVE-2026-46331 and CVE-2026-52951 and advised organizations to obtain distributor updates from vendors such as Red Hat and Ubuntu.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
ubuntu.com
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourceubuntu.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A long-standing flaw in Linux `KVM/x86` shadow paging, tracked as **CVE-2026-53359** and dubbed **Januscape**, can let a guest corrupt host kernel memory and potentially escape isolation. The bug is a use-after-free in KVM shadow MMU emulation caused by incomplete cleanup logic that left stale references to freed page-table tracking structures; reporting indicates earlier validation checked only the guest frame number and not the page role. The issue affects both Intel and AMD hosts, has reportedly existed since Linux kernel `2.6.36`, and was disclosed as a vulnerability that can be triggered solely through guest-side actions.
Jul 12, 2026
Linux distributors released security updates to fix multiple **Linux kernel** vulnerabilities that could let attackers bypass security restrictions, trigger denial-of-service conditions, obtain sensitive information, escalate privileges, execute arbitrary code, and gain access to affected systems. The advisory specifically highlighted `CVE-2025-10263`, a local race condition in Translation Lookaside Buffer invalidation operations rated **CVSS 8.4**, and `CVE-2026-46316`, a local **guest-to-host escape** vulnerability rated **CVSS 7.0**. The notice said a proof-of-concept exploit for `CVE-2026-46316` has been disclosed and is circulating in the wild, increasing the urgency for remediation. **Red Hat** and **Ubuntu** were identified as distributors providing fixes, and organizations were urged to validate and deploy patches promptly and monitor their vendors for any additional kernel-related updates.
Jul 8, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026