EXECUTIVE SUMMARY
A critical use-after-free (UAF) vulnerability, tracked as CVE-2026-53359 and dubbed Januscape, has been identified in the Linux Kernel-based Virtual Machine (KVM) hypervisor. The vulnerability resides within the legacy Shadow Memory Management Unit (Shadow MMU) implementation used by KVM/x86 on both Intel (VMX) and AMD (SVM) virtualization platforms. Successful exploitation allows a privileged attacker within a guest virtual machine (VM) to corrupt host kernel memory, potentially resulting in a host kernel panic (Denial-of-Service) or arbitrary code execution on the host, leading to a guest-to-host escape. Organizations operating Linux KVM-based virtualization infrastructure should promptly assess their environments and apply the latest vendor security updates.
- CVE: CVE-2026-53359
- CVSS: Not yet assigned by NVD; SUSE rates the vulnerability 8.8 (CVSS v3.1) / 9.3 (CVSS v4.0)
- Active Region: Global
- Affected Sector: Cloud Service Providers, Financial Services, Government, Data Centers, Virtualization Infrastructure, Enterprise IT, Managed Hosting Providers
- Affected Product: Linux Kernel KVM/x86 (Intel VMX and AMD SVM)
- Severity: High
- Published Date: July 07, 2026
TECHNICAL DETAILS
CVE-2026-53359 (Januscape) is a high-severity use-after-free (UAF) vulnerability affecting the legacy Shadow Memory Management Unit (Shadow MMU) implementation in the Linux Kernel-based Virtual Machine (KVM) hypervisor. The flaw occurs because KVM incorrectly reuses shadow page structures by validating only the Guest Frame Number (GFN) while failing to verify the associated shadow page role. This improper validation allows incompatible shadow page types to be reused, resulting in stale pointer dereferencing and corruption of KVM’s internal memory management structures. Under specific conditions, a privileged attacker within a guest virtual machine can exploit this memory corruption to trigger a host kernel panic (Denial-of-Service). According to the security researcher, more advanced exploitation techniques may achieve arbitrary code execution on the host, resulting in a guest-to-host escape.
- Target: Linux Kernel KVM/x86 hypervisors running on Intel (VMX) and AMD (SVM) platforms, particularly cloud environments, enterprise virtualization infrastructure, and systems utilizing nested virtualization.
- Root Cause: Improper validation during shadow page reuse within KVM’s legacy Shadow MMU implementation. The reuse logic validates only the Guest Frame Number (GFN) and does not verify the associated shadow page role, allowing….
