Back Securityaffairs.Co

Januscape: 16-Year

Securityaffairs.Co •Pierluigi Paganini • July 7, 2026

Januscape: A 16-year-old Linux KVM flaw lets cloud VM tenants crash hosts and potentially escape guests. It affects Intel and AMD systems. Security researcher Hyunwoo Kim has published details of a use-after-free vulnerability in Linux’s KVM hypervisor that allows code running inside a guest virtual machine to corrupt host kernel memory. The bug, tracked as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Januscape Vulnerability in Linux KVM Exposes Cloud Servers to Attacks A critical vulnerability in Linux KVM, named Januscape (CVE-2026-53359), has been discovered after lying dormant for 16 years. This flaw allows attackers with root access in a guest virtual machine to escape to the host and execute arbitrary code, affecting both Intel and AMD systems. The vulnerability stems from a use-after-free issue in KVM's shadow MMU emulation, which can lead to host kernel crashes or full control over the host and other guests. The bug was disclosed by researcher Hyunwoo Kim and has been patched as of July 4, 2026. It poses a significant risk to multi-tenant cloud environments, such as those used by major providers like Google Cloud and AWS. Administrators are urged to apply the patch immediately to mitigate risks. 20 sources 74

Extracted Entities

Januscape: 16-Year

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (2)

Vulnerabilities (1)