OVH rolls out emergency patch for KVM flaw CVE-2026-53359

OVH, a European cloud provider, executed an emergency patch to resolve a critical security flaw (CVE-2026-53359) in KVM virtualization, affecting tens of thousands of servers and around a million virtual machines within ten days. This flaw, a use-after-free bug, could allow attackers to crash hosts or escape virtual machines, posing a severe risk. OVH opted for a disruptive upgrade without notifying all clients, fearing that individual scheduling could lead to greater risk.

Although this decision caused some virtual machines to experience interruptions, OVH believed immediate action was necessary to prevent potential exploits. The patch rollout faced challenges, including hardware malfunctions and service disruptions, necessitating on-site technical support. Ultimately, OVH maintains that prioritizing customer security justifies the abrupt upgrade approach, emphasizing the importance of developing redundancy in cloud setups.