A newly disclosed Linux KVM flaw dating back 16 years could let attackers escape guest VMs and compromise x86 hosts running nested virtualization.
A security flaw that went unnoticed in Linux for more than 16 years could allow an attacker to escape from a virtual machine and potentially take control of the host system, according to newly released research.
The vulnerability, tracked as CVE-2026-53359 and dubbed Januscape, affects the Kernel-based Virtual Machine (KVM) hypervisor used by Linux. Researchers say the bug has been present in KVM’s x86 code since 2009 and impacts both Intel- and AMD-based systems.
At the heart of the issue is a use-after-free vulnerability in KVM’s legacy shadow memory management code. While much of today’s virtualization relies on newer hardware-assisted technologies, the older code is still used when nested virtualization is enabled, creating an opening for attackers in certain environments.
Researchers demonstrated that the flaw can reliably crash a host operating system from inside a guest virtual machine. They also developed a separate exploit capable of escaping the virtual machine entirely, although that proof-of-concept has not been made public.
The attack is not considered trivial. An attacker would first need root privileges inside the guest virtual machine, and the host must have nested virtualization enabled. Even so, organizations that allow customers or untrusted users to run their own virtual machines could face a greater risk because those conditions are more likely to exist.
Unlike some virtualization vulnerabilities that involve software such as QEMU, this bug resides entirely within the Linux kernel’s KVM implementation. That means applying the latest kernel updates is the only permanent fix.
The vulnerability has now been patched in supported Linux kernel releases, with the fix rolling out on July 4, 2026. Many Linux distributions are also expected to backport the update to older kernel versions, so administrators should check their vendor’s security advisories rather than relying solely on kernel version numbers.
For systems that cannot be patched immediately, researchers recommend disabling nested virtualization where possible. While that may not be practical in every environment, it removes the attack path exploited by Januscape until updates can be applied.
Although there are no public reports of the flaw being exploited, security experts say organizations running shared or multi-tenant virtualization infrastructure should not ignore it. Bugs that allow a virtual machine to interact with the underlying host are relatively uncommon, and when they do emerge, they are often treated as high-priority because of the potential impact if successfully exploited.
Related articles :
- CISA Warns of Exploited Joomla JCE RCE Flaw
- Quasar Linux RAT Targets Developers, Steals Keys
- NCA Launches Operation Atlantic Against Crypto Phishing
Reports are sourced from official documents, law-enforcement updates, and credible investigations.
Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.
