Overview
- Security researcher Hyunwoo Kim disclosed Januscape (CVE-2026-53359), a use-after-free bug in KVM's shadow MMU that affects both Intel and AMD x86 hosts.
- A public proof-of-concept published on July 6 reliably triggers a host kernel panic from a guest VM and the researcher says a withheld exploit can escalate that to full host code execution.
- The bug stems from KVM reusing shadow page tracking entries by address alone instead of also checking the page role, which can make the kernel write into freed memory and corrupt host state.
- The upstream one-line fix was merged into mainline in June and fixed stable kernels were shipped on July 4, 2026, so operators should verify package changelogs and apply updates.
- Hosts that cannot be patched immediately should disable nested virtualization to remove the attack path, and cloud operators who accept untrusted guests should treat affected x86 machines as high-priority to secure.