Loading story…
A long-standing flaw in Linux KVM/x86 shadow paging, tracked as CVE-2026-53359 and dubbed Januscape, can let a guest corrupt host kernel memory and potentially escape isolation. The bug is a use-after-free in KVM shadow MMU emulation caused by incomplete cleanup logic that left stale references to freed page-table tracking structures; reporting indicates earlier validation checked only the guest frame number and not the page role. The issue affects both Intel and AMD hosts, has reportedly existed since Linux kernel 2.6.36, and was disclosed as a vulnerability that can be triggered solely through guest-side actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
AlmaLinux announced patched kernel builds in its testing repository for Januscape (CVE-2026-53359), saying it backported fixes for affected AlmaLinux 8, 9, and 10 branches. The vendor said it released the testing builds ahead of CentOS Stream/RHEL updates because of the vulnerability's severity.
A later report said the vulnerability was fixed in the July 2026 stable kernel updates. The write-up described the bug as long-lived, dating back to Linux kernel 2.6.36, and urged KVM hosts to apply vendor kernel updates.
The oss-sec disclosure stated that CVE-2026-53359 had been patched in mainline Linux. The flaw affects KVM/x86 on both Intel and AMD hosts and can enable guest-to-host escape or local privilege escalation in some configurations.
Hyunwoo Kim disclosed Januscape (CVE-2026-53359), a guest-to-host escape vulnerability in KVM/x86 caused by a use-after-free in shadow MMU emulation. The disclosure said the issue had been reported to the Linux kernel security team, noted successful 0-day use in Google kvmCTF, and included a denial-of-service proof of concept plus technical details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcedarkwebinformer.com
Open sourcegit.kernel.org
Open sourceseclists.org
Open sourcethecybersecguru.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A use-after-free vulnerability in KVM's shadow paging code was disclosed after researchers Alexander Bulekov and Fred Griffoul of Amazon found stale reverse mappings in shadow EPT through fuzzing. The flaw affects x86 guests and is exploitable when nested virtualization is enabled on Intel or AMD processors, or when systems use shadow paging with EPT or NPT disabled. Maintainers said the bug can lead to kernel memory corruption and denial of service on the host, making it a guest-to-host risk in affected virtualization setups. The disclosure was coordinated by Sandipan Roy, who said reporters and maintainers agreed to an embargo that ended on March 29, 2026 at 16:00 UTC. Solar Designer said the issue had first been shared with the `linux-distros` list on March 10, 2026 and acknowledged the embargo exceeded that list's usual 14-day limit without prior approval, though it was allowed because the overrun was moderate and multiple stakeholders were already involved. The discussion also noted that on Linux kernels `6.16` and newer, the reproducer hits a `WARN` introduced by commit `11d45175111d`, raising questions about whether `panic_on_warn` could reduce exploitability.
Jun 29, 2026
A critical guest-to-host escape vulnerability in KVM on **arm64** systems, tracked as **`CVE-2026-46316`** and dubbed **ITScape**, was publicly disclosed with working proof-of-concept exploit code. Researcher **Hyunwoo Kim** reported that the flaw resides in the in-kernel **vGIC-ITS** implementation, where a race condition and double-put use-after-free in `vgic_its_invalidate_cache()` can be triggered entirely from an untrusted guest VM, allowing execution of commands on the host with **kernel privileges**. The issue affects arm64 Linux kernels spanning builds from late April 2024 through early June 2026 and raises particular concern for **multi-tenant public cloud** environments running unpatched arm64 KVM hosts. The published PoC reportedly demonstrates host-kernel code execution on `aarch64`, including creation of a root-owned `/ITScape` file on the host, while Linux kernel maintainers have already merged a fix that changes `vgic_put_irq()` handling based on the return value of `xa_erase()`. The disclosure also advises applying additional related patches, including one addressing **`CVE-2026-46317`**.
Jun 29, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026