https://seclists.org/oss-sec/2026/q3/64: Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359)
Published Jul 6, 2026
·Updated
Affected Software
1 affected component
KVM KVM/x86 (shadow MMU emulation)
Frequently Asked Questions
1
Which environments are most exposed to this issue?
KVM/x86 hosts that accept untrusted guests and expose nested virtualization are particularly exposed. The report specifically identifies multi-tenant x86 public-cloud environments as a concern, and states that both Intel- and AMD-based hosts are affected.
2
Does exploitation require access or cooperation from the host?
No. The vulnerability can be triggered through guest-side actions alone, allowing a guest to corrupt a host-kernel shadow page and potentially break guest-host isolation.
3
Can this be used for local privilege escalation rather than a VM escape?
Yes. On distributions where /dev/kvm is world-writable (0666), such as RHEL according to the report, an unprivileged local user could use the issue to gain root.
4
Is there an upstream fix available?
Yes. The report states that CVE-2026-53359 has been patched in mainline Linux.