Loading story…
OVHcloud disclosed that it carried out an emergency patch campaign for CVE-2026-53359 (Januscape), a critical Linux KVM guest-to-host escape vulnerability that could let an attacker with root access inside a virtual machine execute code as root on the host, crash the host, or compromise neighboring VMs. To reduce the window for exploitation, the provider kept operational details limited while it backported a fix into its production Debian environment and pushed the update across infrastructure supporting roughly tens of thousands of hosts and about one million VMs.
Rather than disable nested virtualization, rely on live patching, or attempt fleet-wide live migration, OVH tested the process first in its Sydney region and then executed staged mass reboots across its cloud platform, without offering customers an opt-out. The company said the response caused downtime and multiple side effects, including VM restart failures, forced-shutdown data corruption, OpenStack API instability, HTTP 503 errors, traffic spikes at a Canadian site, and hardware failures on some hosts, and it is now conducting a post-mortem on the operation.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The reboot campaign caused downtime and multiple operational problems, including VM restart failures, data corruption during forced shutdowns, OpenStack API instability, HTTP 503 errors, traffic spikes at a Canadian site, and hardware failures on some hosts. These issues occurred during the large-scale remediation effort.
OVH then deployed the patched kernel across tens of thousands of hosts supporting about one million virtual machines, using staged reboot waves and not offering customers an opt-out. The company kept details of the plan quiet while execution was underway to reduce the risk of exploitation before patching completed.
OVH first tested its emergency patching and reboot process in its Sydney region before expanding the operation. The Sydney deployment served as a trial run for the broader fleet-wide mitigation.
Rather than disable nested virtualization, rely on live patching, or attempt fleet-wide live migration, OVH chose to backport a fix for the Januscape flaw into its production Debian environment. The decision set up a large-scale emergency remediation across its KVM fleet.
OVH said details of the Januscape vulnerability, CVE-2026-53359, and a publicly available exploit created urgency because an attacker with root access in a guest VM could escape to the host and affect other guests. This public exploitability drove the emergency mitigation effort.
OVH publicly disclosed how it handled CVE-2026-53359 and said it is conducting a post-mortem to improve future responses to major kernel vulnerabilities. The company described the rationale for its mitigation choices and the impact of the operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcetheregister.com
Open sourcetheregister.com
Open sourceblog.ovhcloud.com
Open sourcecsirt.sk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubuntu disclosed mitigation guidance for **CVE-2026-53359** ("**Januscape**"), a Linux kernel local privilege escalation flaw affecting nested virtualization in **KVM** on Intel and AMD `x86_64` systems. The issue impacts Ubuntu releases from **14.04 through 26.04**, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the **hypervisor kernel**, while **unprivileged containers are not affected**; however, privileged containers and systems exposing `/dev/kvm` to non-privileged users may face elevated risk. Canonical's Ubuntu CVE tracker lists **CVE-2026-53359** among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including `linux`, `linux-hwe`, `linux-hwe-5.4`, `linux-hwe-5.8`, and `linux-hwe-5.11`, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including **CVE-2026-46331**, a `pedit` subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and **CVE-2026-52951**, a `drm/xe/dma-buf` use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.
Jul 14, 2026
A long-standing flaw in Linux `KVM/x86` shadow paging, tracked as **CVE-2026-53359** and dubbed **Januscape**, can let a guest corrupt host kernel memory and potentially escape isolation. The bug is a use-after-free in KVM shadow MMU emulation caused by incomplete cleanup logic that left stale references to freed page-table tracking structures; reporting indicates earlier validation checked only the guest frame number and not the page role. The issue affects both Intel and AMD hosts, has reportedly existed since Linux kernel `2.6.36`, and was disclosed as a vulnerability that can be triggered solely through guest-side actions.
Aug 25, 2026
A critical guest-to-host escape vulnerability in KVM on **arm64** systems, tracked as **`CVE-2026-46316`** and dubbed **ITScape**, was publicly disclosed with working proof-of-concept exploit code. Researcher **Hyunwoo Kim** reported that the flaw resides in the in-kernel **vGIC-ITS** implementation, where a race condition and double-put use-after-free in `vgic_its_invalidate_cache()` can be triggered entirely from an untrusted guest VM, allowing execution of commands on the host with **kernel privileges**. The issue affects arm64 Linux kernels spanning builds from late April 2024 through early June 2026 and raises particular concern for **multi-tenant public cloud** environments running unpatched arm64 KVM hosts. The published PoC reportedly demonstrates host-kernel code execution on `aarch64`, including creation of a root-owned `/ITScape` file on the host, while Linux kernel maintainers have already merged a fix that changes `vgic_put_irq()` handling based on the return value of `xa_erase()`. The disclosure also advises applying additional related patches, including one addressing **`CVE-2026-46317`**.
Jun 29, 2026