Januscape bug lets a rooted Linux KVM guest escape to the host on Intel and AMD

Security researcher Hyunwoo Kim disclosed on July 6 a Linux KVM hypervisor bug, named Januscape, that lets an attacker with root inside a guest virtual machine escape to the host on both Intel and AMD systems. The use-after-free flaw, tracked as CVE-2026-53359, affects x86 hosts running the open-source hypervisor.

The flaw sits in KVM’s shadow MMU code and traces back to a kernel change from August 2010 — roughly 16 years of latency. Kim describes it as the first publicly documented guest-to-host KVM escape triggerable on both Intel and AMD architectures. On a host with nested virtualization enabled, an escape can crash every other tenant VM on the same physical machine, and Kim says a withheld exploit achieves full host code execution as root. The Januscape disclosure and proof-of-concept were submitted as a zero-day to Google’s kvmCTF bug-bounty program, which pays up to $250,000 for a full guest-to-host escape.

The exposure lands on the exact configuration much of the public cloud runs on. Multi-tenant, nested-virtualization workloads on x86 KVM hosts underpin services at major providers including Amazon Web Services and Google Cloud, where a single-tenant escape that can take down neighboring VMs is close to a worst case.

Fixes are already out. Patched stable kernels shipped July 4, 2026: versions 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211 and 5.10.260. Operators who cannot patch immediately can disable nested virtualization with kvm_intel.nested=0 or kvm_amd.nested=0.

Some claims rest on Kim’s own account. The full-root-execution exploit has been withheld and not published, so its reliability cannot be independently verified, and no cloud provider has confirmed exposure or exploitation. What is established is the patched code path and the long dormancy of the underlying bug.