Januscape (CVE-2026-53359) is a use-after-free vulnerability in the shadow MMU code of the Linux KVM hypervisor that enables VM escape attacks on both Intel and AMD systems. Discovered by researcher Hyunwoo Kim, it allows an attacker with root privileges inside a guest VM to corrupt the host kernel's shadow page state, leading to potential full host compromise. This includes denial of service affecting all VMs on the host or remote code execution with root privileges on the host. The vulnerability remained undisclosed for 16 years before being patched in mainline Linux kernel on June 19, 2026 (commit 81ccda30b4e8). It is particularly critical for multi-tenant public cloud environments where untrusted guests run nested virtualization. Exploitation requires root access inside the guest VM, which is typically available by default in cloud instances, or can be combined with other privilege escalation bugs. No public exploits are known at this time.

Successful exploitation of Januscape allows an attacker with root access inside a guest VM to escape the virtual machine and execute arbitrary code on the host system. This can lead to full host compromise, including control over all other guest VMs on the same physical host. It also enables denial of service attacks that can crash the host kernel, affecting all tenants sharing the host. On certain Linux distributions like Red Hat Enterprise Linux, unprivileged users may escalate privileges to root by exploiting this flaw combined with other vulnerabilities. The vulnerability affects both Intel and AMD architectures, increasing its impact scope.

A patch for CVE-2026-53359 was merged into the Linux kernel mainline on June 19, 2026 (commit 81ccda30b4e8). Administrators should update to the latest Linux kernel versions that include this fix. Since this is a kernel-level vulnerability affecting KVM, applying the official kernel patch is the primary mitigation. No vendor advisory indicates that no action is required or that the issue is already mitigated. Users of public cloud services should verify with their providers that the underlying hosts have been patched. Until patched, restricting root access inside guest VMs and monitoring for privilege escalation attempts can reduce risk.