Skip to content
Critical Januscape Vulnerability in Linux KVM Exposes Cloud Servers to Attacks

Critical Januscape Vulnerability in Linux KVM Exposes Cloud Servers to Attacks

First seen 7 Jul 2026, 12:27 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 8, 2026 at 10:18 UTC
  • •Januscape (CVE-2026-53359) allows guest VMs to escape and control the host system.
  • •The vulnerability has existed for 16 years and affects both Intel and AMD architectures.
  • •A patch has been released; administrators must ensure it is applied to secure their systems.

A critical vulnerability in Linux KVM, named Januscape (CVE-2026-53359), has been discovered after lying dormant for 16 years. This flaw allows attackers with root access in a guest virtual machine to escape to the host and execute arbitrary code, affecting both Intel and AMD systems. The vulnerability stems from a use-after-free issue in KVM's shadow MMU emulation, which can lead to host kernel crashes or full control over the host and other guests. The bug was disclosed by researcher Hyunwoo Kim and has been patched as of July 4, 2026. It poses a significant risk to multi-tenant cloud environments, such as those used by major providers like Google Cloud and AWS. Administrators are urged to apply the patch immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 90d ago How this analysis works

Timeline

2026-05-08
CVE-2026-43284 published
A local privilege escalation flaw was disclosed, affecting major Linux distributions.
Bleepingcomputer
2026-05-11
CVE-2026-43500 published
Another Linux vulnerability was disclosed, allowing privilege escalation on various distributions.
Bleepingcomputer
2026-07-04
CVE-2026-53359 published
The Januscape vulnerability was officially disclosed and patched in the Linux kernel.
Cybernews
2026-07-07
Public PoC released
Hyunwoo Kim published a proof-of-concept code demonstrating the exploit's impact.
Cybernews

More articles in this cluster (32)

Following this threat?

Track CVE-2022-0847 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 3