Kvm

KVM, or Kernel-based Virtual Machine, is a virtualization technology built into the Linux kernel that enables guest operating systems to run on x86-based host systems using hardware virtualization extensions. It operates by leveraging CPU virtualization features on Intel and AMD processors and provides isolation between guest and host environments. A critical vulnerability, CVE-2026-53359, known as 'Januscape', allows a guest VM to trigger a use-after-free bug in the shared shadow MMU code, corrupting the host kernel's shadow-page state. This flaw can lead to host kernel panic or execution of code with root privileges. The vulnerability has existed for 16 years and was only recently disclosed, raising concerns about long-term security maintenance. KVM is widely used in cloud and server environments, making it a critical component in multi-tenant virtualization infrastructures.

A 16-year-old vulnerability in KVM's shared shadow MMU code, CVE-2026-53359, dubbed 'Januscape', has been publicly disclosed and confirmed to allow guest VMs to escape to the host and execute code with root privileges. The flaw can be triggered from within a guest virtual machine and affects both Intel and AMD x86 systems. Stable versions of the Linux kernel were patched and released on July 4, 2026, including 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, and 5.10.260. The National Vulnerability Database (NVD) has not yet assigned a CVSS score; security experts advise immediate action for systems accepting multi-tenant guests. The fact that this flaw has remained undetected for so long highlights a gap in long-term security auditing of widely deployed open-source virtualization software.