Linux KVM Januscape (CVE-2026-53359): Guest-to-Host Escape

How the Linux KVM Januscape flaw works

The shadow MMU is the KVM component that maintains private page tables mirroring guest memory. To run a VM, KVM keeps its own set of tracking pages and reuses existing ones when it can. Januscape abuses that reuse logic.

Kim described Januscape as the first guest-to-host exploit triggerable on both Intel and AMD, to public knowledge. He submitted it as a zero-day to Google's kvmCTF, the controlled KVM reward program that pays up to $250,000 for full guest-to-host escapes.

The problem is subtle. KVM matched pages by memory address alone and ignored the type of tracking page it was grabbing. Two different types can share the same address but do different jobs, so KVM would sometimes reuse the wrong kind. That mix-up scrambles KVM's internal records of which page belongs where.

Most of the time the kernel notices the inconsistency and shuts itself down to avoid damage. That's the host panic the public PoC triggers. The rarer, worse case happens when the freed tracking page is handed out for another use before cleanup runs. Cleanup then writes a value into memory KVM no longer owns. An attacker controls where that write lands, not what gets written, and even that limited primitive can lead to code execution on the host.

The flaw behaves the same on Intel and AMD chips. Only the final, hardest step of turning it into full control needs vendor-specific work, and the PoC carries a separate code path for each.

Root cause of the Linux KVM Januscape bug (CVE-2026-53359)

Januscape's root cause is a shadow-page reuse mismatch. KVM matched candidate pages by guest frame number (gfn) alone and ignored the page role, so it sometimes reused a page built for a different job. That corrupts KVM's shadow-page state.

We pulled the diff for commit 81ccda30b4e8 and confirmed the one-line change adds role.word to the reuse check in kvm_mmu_get_child_sp(): the pre-fix code matched pages by frame number alone.

Exploitation needs two conditions on the guest side: root inside the VM, common on rented cloud instances, and nested virtualization exposed by the host. Even on hosts that run hardware EPT or NPT by default, nested virtualization forces KVM back through the legacy shadow MMU, where the bug sits. See the commit on git.kernel.org (81ccda30b4e8).

Who is affected by CVE-2026-53359?

Januscape hits operators of x86 KVM hosts that run untrusted multi-tenant guests with nested virtualization enabled. Its worst-case impact is a full guest-to-host escape: the withheld exploit runs code as root on the host, exposing every other guest on the same machine to that root access.

Even the reliable path, a host panic, downs every co-tenant VM at once, so a single malicious tenant can cause a multi-tenant outage and, in the worst case, read across the tenant boundary. On distributions like RHEL, where /dev/kvm is world-writable (0666), the same bug could serve as a local privilege escalation to root. ARM64 hosts are not affected.

Januscape is Kim's third Linux kernel disclosure in roughly two months, after Dirty Frag (CVE-2026-43284 / CVE-2026-43500) in May 2026 and ITScape (CVE-2026-46316), the first public KVM/arm64 guest-to-host escape, in June.

Google launched kvmCTF in 2024 because KVM underpins both Android and Google Cloud. A related KVM x86 shadow-paging use-after-free (CVE-2026-46113) was fixed in May 2026, making two shadow MMU use-after-frees in the same legacy path within two months.

How to patch CVE-2026-53359

The fix is a one-line addition to kvm_mmu_get_child_sp(): the reuse condition now checks role.word alongside the gfn, so a shadow page is reused only when both the frame number and the role match. KVM maintainer Paolo Bonzini wrote the patch, merged into mainline on June 19, 2026.

Fixed stable versions shipped July 4, 2026: 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, and 5.10.260. We verified these tags are published on kernel.org. NVD has not yet assigned a CVSS score; don't wait for one.

1. Confirm that your x86 KVM host kernel includes commit 81ccda30b4e8.
2. Check the distribution package changelog rather than relying on uname -r alone, since backports may carry the fix under a different version number.
3. If you can't patch immediately, disable nested virtualization to remove the attack path for untrusted guests.

# Intel hosts
kvm_intel.nested=0

# AMD hosts
kvm_amd.nested=0