A sixteen‑year‑old flaw in the Linux Kernel‑based Virtual Machine has been shown to allow a guest virtual machine to break out and take control of the host system. The Hacker News reported the discovery, noting that the issue affects both Intel and AMD x86 platforms.
Tracked as CVE‑2026-53359, the vulnerability is a use‑after‑free error in the KVM shadow memory handling code. SecurityOnline.info detailed how the flaw can be triggered from within a guest VM to execute arbitrary code with root privileges on the host. CVSS has not been assigned, but the flaw remains exploitable on unpatched kernels.
A public exploit named Januscape is available on GitHub, demonstrating how a malicious guest can overwrite host memory. So far there are no reports of the flaw being used in the wild and no threat actors have been linked to it. The proof‑of‑concept shows that exploitation is straightforward in environments that allow nested virtualization.
Cloud providers and enterprises that run multi‑tenant workloads are particularly exposed because a compromised guest could attack the underlying host and other tenants. Although ARM64 guests are not affected, the vast majority of x86 based cloud instances remain at risk until patched. The disclosure adds to a growing list of long‑lived hypervisor bugs that have resurfaced after years of dormancy.
Administrators should prioritize applying the latest kernel updates from their Linux distribution, which include the fix for CVE‑2026-53359. Where immediate patching is not possible, disabling nested virtualization reduces the attack surface. Monitoring guest VMs for unusual system calls or memory accesses can help detect an escape attempt early.
Staying subscribed to vendor security mailing lists and checking the kernel changelog for the specific CVE ensures that future regressions are caught quickly. Virtualisation hardening guides also recommend limiting privileged devices and using SELinux or AppArmor profiles to contain guest processes.