One Rented VM. Sixteen Years. And a Clean Path to the Whole Server.

What Happened?

Security researcher Hyunwoo Kim, who goes by v4bel, disclosed a KVM flaw VM escape bug he named Januscape, tracked as CVE-2026-53359. KVM is the piece of Linux that lets one server run many isolated virtual machines. Nearly every big cloud provider relies on it.

The bug is a use-after-free in KVM’s shadow MMU, the part that keeps private page tables mirroring each guest’s memory. When KVM needed to reuse one of those tracking pages, it matched by memory address alone and ignored the page type. Two different page types can share an address but do different jobs, so KVM sometimes grabbed the wrong one. That mix-up corrupts its internal records, and once those go bad, the host kernel is in trouble.

Here is the detail that makes this one stand out. It is the first KVM guest-to-host escape that fires on both Intel and AMD chips. The trigger is identical on both. Only the final step of turning it into full control differs by vendor.

Kim demonstrated it as a zero-day in Google’s kvmCTF, the program that pays up to $250,000 for a full VM escape. The vulnerable code traces back to a commit from August 2010. Maintainer Paolo Bonzini fixed it upstream in mid-June, and stable kernel releases landed on July 4.

The Impact

Two conditions make a system exploitable: root inside the guest VM, which cloud tenants usually get by default, and nested virtualization exposed by the host. Even on hardware that uses EPT or NPT, turning on nested virtualization drops KVM back into the old shadow MMU code where the bug lives.

The public proof-of-concept panics the host. That alone is bad. An attacker who rents one instance can crash the physical server and take down every other tenant VM sharing it. Kim says a second, unreleased exploit runs code as root on the host, which would put every neighbor on that machine inside the blast radius. On distributions like RHEL where /dev/kvm is world-writable, the same bug can also serve as local privilege escalation.

VM escapes are among the nastiest attacks in enterprise environments, and Januscape is Kim’s third KVM disclosure in roughly ten weeks.

How to Avoid This

Patch the host kernel. That is the real fix.

Move to a fixed stable release (7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, or 5.10.260) or your vendor’s backport, and confirm the version against your distribution’s tracker rather than the upstream number. Debian shipped a fix on July 5. Red Hat and several SUSE builds were still pending in early July.

Can’t patch right away? Disabling nested virtualization (kvm_intel.nested=0 or kvm_amd.nested=0) removes the attack path entirely, as long as your workloads don’t need it. For Proxmox VE update pve-kernel; for oVirt, update the underlying distribution kernel.