https://seclists.org/oss-sec/2026/q3/64: Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359)

Published Jul 6, 2026

Updated

Affected Software

1 affected component

KVM KVM/x86 (shadow MMU emulation)

Frequently Asked Questions

Which environments are most exposed to this issue?

KVM/x86 hosts that accept untrusted guests and expose nested virtualization are particularly exposed. The report specifically identifies multi-tenant x86 public-cloud environments as a concern, and states that both Intel- and AMD-based hosts are affected.

Does exploitation require access or cooperation from the host?

No. The vulnerability can be triggered through guest-side actions alone, allowing a guest to corrupt a host-kernel shadow page and potentially break guest-host isolation.

Can this be used for local privilege escalation rather than a VM escape?

Yes. On distributions where /dev/kvm is world-writable (0666), such as RHEL according to the report, an unprivileged local user could use the issue to gain root.

Is there an upstream fix available?

Yes. The report states that CVE-2026-53359 has been patched in mainline Linux.

https://seclists.org/oss-sec/2026/q3/64: Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359)

Affected Software

Frequently Asked Questions

Which environments are most exposed to this issue?

Does exploitation require access or cooperation from the host?

Can this be used for local privilege escalation rather than a VM escape?

Is there an upstream fix available?

Company

Resources

Contact

Frequently Asked Questions

Which environments are most exposed to this issue?

Does exploitation require access or cooperation from the host?

Can this be used for local privilege escalation rather than a VM escape?

Is there an upstream fix available?