Januscape (CVE-2026-53359): The KVM Bug That Lets a VM Escape to the Host

In July 2026, researchers disclosed Januscape (CVE-2026-53359) - a use-after-free bug in the Linux kernel's KVM hypervisor that had gone unnoticed for roughly 16 years. It lets a guest virtual machine escape to the host it runs on, on both Intel and AMD. Here's what it means and exactly what to do.

What is Januscape (CVE-2026-53359)?

Januscape is a use-after-free vulnerability in KVM's shadow MMU - the part of the Linux kernel that manages memory for virtual machines when nested virtualization is in play. A malicious guest can force KVM to reuse a cached "shadow page" with the wrong role, leaving stale memory references an attacker can abuse. In the worst case, code running inside a guest VM can break out and run on the host kernel as root.

Two things make it serious. First, it is a guest-to-host escape - it breaks the boundary that is supposed to keep tenants isolated on shared hardware. Second, it works on both Intel and AMD x86 systems and needs no cooperation from QEMU or any userspace component: it is a pure in-kernel KVM bug. It also sat undiscovered for about 16 years, which is why it earned a name.

Who is actually at risk?

This is not a "patch every server on earth tonight" bug for most people. The attack path needs two conditions on the host: it must run untrusted guest VMs, and those guests must have nested virtualization enabled. In practice that means:

• Multi-tenant cloud / VPS providers that let customers run their own VMs (including nested hypervisors).
• Anyone renting out VMs where the guest is controlled by someone you don't trust.
• The attacker also needs root inside a guest - which, on a VM they rented, they already have.

If you run a single-tenant server, or your VMs are all your own and you don't hand root to strangers, the practical risk is far lower. But the fix is cheap, so patch anyway.

How to fix it: patch the kernel

The bug was fixed upstream (commit 81ccda30b4e8) and backported to the stable kernels. Fixed stable versions shipped on 4 July 2026:

• 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211 and 5.10.260.

Update your kernel to at least the fixed version in your series, then reboot so the new kernel is actually running (a patched kernel on disk does nothing until you boot into it). Enterprise distributions - Rocky, AlmaLinux, Debian, Ubuntu - backport KVM fixes into their own kernel numbers, so trust your vendor's advisory over the raw upstream version string.

Can't patch yet? Disable nested virtualization

If you can't reboot into a new kernel immediately, the clean mitigation is to turn off nested virtualization, which removes the attack path entirely for untrusted guests:

• On Intel hosts, add options kvm_intel nested=0 to a file under /etc/modprobe.d/ (on AMD: options kvm_amd nested=0).
• Reload the module or reboot, then confirm with cat /sys/module/kvm_intel/parameters/nested - it should read N or 0.

Most VPS and game-hosting workloads do not need nested virtualization, so disabling it is usually painless.

The bigger lesson: isolation is your host's job

Januscape is a reminder that on shared hardware, the strength of the wall between tenants depends entirely on the operator keeping the hypervisor patched. A well-run host tracks kernel CVEs, patches quickly, and limits who can run untrusted nested guests in the first place. See our rundown of famous Linux vulnerabilities, the Linux VPS hardening checklist, and what's changing in Linux security for the wider picture.

On shared hardware, tenant isolation is only as strong as the hypervisor underneath it - and that is only as strong as how fast your host patches.