RESEARCHERS have disclosed two long‑dormant Linux kernel flaws, dubbed GhostLock and Januscape, that enable unprivileged users to break out of virtual machines and gain root privileges on the host (Ars Technica reported). The flaws were identified this week after remaining hidden in the code base for over a decade. GhostLock allows a local user with limited rights to escalate to root and break out of containers. Januscape lets a malicious guest virtual machine execute code on the hypervisor host, threatening isolation in multi‑tenant clouds.
GhostLock, formally CVE-2026-43499, is a use‑after‑free bug affecting kernel releases from 2.6.39‑rc1 up to 7.1‑rc1 and carries a CVSS score of 7.8 (The Hacker News detailed the issue). Exploitation requires only local access and can lead to full privilege escalation and container breakout. Januscape, recorded as CVE-2026-53359, resides in the KVM shadow MMU, impacts Intel and AMD x86 platforms and is rated CVSS 10 (SecurityWeek explained the flaw). The flaw permits a compromised VM to corrupt host kernel memory, effectively granting the attacker root on the underlying server.
GhostLock was uncovered by Nebula Security’s AI scanner, which netted a $92,337 bounty from Google’s bug‑hunter programme (the research post). The corresponding technical write‑up is available via the Nebula research portal. Januscape was identified by independent researcher Hyunwoo Kim, who received a $250,000 award and demonstrated the issue in Google’s kvmCTF event (the exploit code is on GitHub). A one‑line patch for Januscape was committed on 4 July 2026 and mitigations for GhostLock are now being rolled out by major Linux distributors.
As of the latest reports, no active attacks leveraging GhostLock or Januscape have been observed in the wild. However, public proof‑of‑concept exploits for both vulnerabilities have been published, lowering the barrier for potential misuse (the NVD entry for Januscape lists the score). The National Vulnerability Database entry for Januscape confirms the critical rating and notes the availability of a fix. While several other CVEs issued this week are already listed in the Known Exploited Vulnerabilities catalogue, no threat actor has been publicly tied to these two Linux kernel bugs.
The discoveries highlight how dormant defects in core virtualisation components can erode trust in cloud environments that rely on strict guest‑host separation (SecurityAffairs noted the 16‑year dormancy). Although the current focus is on the Linux kernel, the same week brought forward separate alerts for Joomla, Langflow and ColdFusion, showing that vulnerability management must cover the full software stack (SecurityOnline listed the accompanying alerts). Organizations that run multi‑tenant workloads should treat these flaws as a reminder that ageing code can hide serious risks for years. Proactive patching and configuration hygiene remain the most effective defences against such legacy issues.
System administrators should apply the latest kernel updates from their Linux distribution as soon as they are available. KVM hosts must be running the patched hypervisor version that includes the one‑line fix for Januscape. Guest configurations ought to be reviewed to strip unnecessary virtual devices and to disable nested virtualisation unless explicitly required. Monitoring host logs for unexpected VM exits, abnormal privilege‑escalation calls or unusual memory accesses can help catch early signs of compromise.
Enforcing least‑privilege principles for workloads and employing network micro‑segmentation can limit the blast radius should an attacker manage to escape a VM.