Skip to content
feed: live
>_ 0dayNews
CVE Record
[ HIGH ] CVE-2026-53359

Linux KVM shadow-MMU use-after-free — guest-to-host escape (Januscape)

Use-after-free in Linux KVM's shadow MMU (in-tree since kernel 2.6.36) lets a guest VM panic — or, per a withheld exploit, root — the host. Patched 2026-06-19.

cat cve-2026-53359.json
Vendor
Linux Foundation
Product
Linux kernel KVM (all mainline releases from 2.6.36 through 7.1.2, plus LTS series 6.18/6.12/6.6/6.1/5.15/5.10 prior to the June 19 stable point releases)
CVSS
8.8
EPSS (exploit probability)
N/A
Status
patched
Published
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-53359

CVE-2026-53359, nicknamed Januscape by its discoverer, is a use-after-free in the Linux KVM shadow-MMU code. In kvm_mmu_get_child_sp(), the shadow-page reuse test matched only on the guest frame number (gfn) and did not check the page’s role bitfield. A guest could arrange for a shadow page built under one role to be handed back for a mapping expecting a different role; the type mismatch corrupts the host kernel’s shadow-page state. NVD has not published its own CVSS. SUSE assigns CVSS v3.1 8.8 and CVSS v4.0 9.3; the frontmatter above follows SUSE’s v3.1 rating pending an NVD score.

Affected

  • Linux mainline — every release from 2.6.36 (Aug 2010) through 7.1.2
  • LTS branches — 6.18 prior to 6.18.38, 6.12 prior to 6.12.95, 6.6 prior to 6.6.144, 6.1 prior to 6.1.177, 5.15 prior to 5.15.211, 5.10 prior to 5.10.260
  • Applies on both Intel and AMD x86 hosts. Exposure is on the host running KVM, not the guest kernel.

Patched

Upstream patch commit 81ccda30b4e8 is a one-line change to kvm_mmu_get_child_sp(): the reuse condition now checks role.word alongside gfn. Merged upstream and backported into the LTS stable series on 2026-06-19. Fixed stable releases: 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, 5.10.260. Distribution kernels lag — SUSE has shipped its advisory; Red Hat, Ubuntu, Debian, Amazon Linux are propagating through their normal cadence.

Exploitation status

  • Public proof of concept from the researcher reliably panics the host kernel from an unprivileged guest.
  • A separate exploit chain claimed to achieve root code execution on the host exists but has been withheld — sourced to the researcher, not independently verified from the public PoC alone.
  • No in-the-wild exploitation reported. Not on CISA KEV at time of publication.

Note on /dev/kvm permissions

On systems where /dev/kvm is world-readable (default 0666 on some Red Hat variants), the effective attack surface expands from “hostile guest” to “any local unprivileged user with access to KVM ioctls.” Red Hat’s advisory flags this configuration specifically. chmod 0660 /dev/kvm with the kvm group restricted to accounts that actually run VMs closes that additional pathway pending the kernel patch.

Sourcing

Related coverage
~/articles/2026-07-07-januscape-cve-2026-53359-kvm-guest-host-escape
Januscape (CVE-2026-53359): 16-year KVM guest-to-host escape
linux kernel

Januscape (CVE-2026-53359): 16-year KVM guest-to-host escape

A 16-year-old use-after-free in KVM's shadow MMU lets a guest VM panic — or, with an unreleased exploit, root — the host on Intel and AMD. Patched June 19.

read →