Januscape Linux KVM Flaw Enables Host Crashes and Reported Guest-to-Host Escape

Januscape (CVE-2026-53359), a reported 16-year-old use-after-free vulnerability in Linux KVM’s x86 shadow MMU code, affects Intel and AMD virtualization platforms. According to SecPod, a privileged guest can trigger a host kernel panic when the vulnerable host exposes nested virtualization. A reliable denial-of-service proof of concept was published on July 6, 2026; a separate, privately held exploit reportedly achieves root-level code execution on the host. The report identifies no observed exploitation in the wild or associated threat actors.

The reported guest-to-host compromise aligns with MITRE ATT&CK’s Escape to Host (T1611) technique and presents particular risk to untrusted, multi-tenant virtualization environments. Administrators should install the fix in commit 81ccda30b4e8 and verify that the related CVE-2026-46113 fix is also present. Until patched, operators should disable nested virtualization and restrict access to /dev/kvm to reduce exposure.