CVE-2026-53359 ("Januscape") - 16-Year-Old Linux KVM Shadow MMU Use-After-Free Exploited as Zero-Day
CVE-2026-53359 ("Januscape") (TL-2026-1189), also tracked as Januscape, is a high-severity software vulnerability, first published 2026-07-10. It has no confirmed attribution, affects Linux Kernel Linux Kernel KVM (x86, arch/x86/kvm/mmu/mmu.c), references 1 CVE (CVE-2026-53359), maps to 16 MITRE ATT&CK techniques (T1005, T1057, T1068), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1189
- Threat ID
- TL-2026-1189
- Also known as
- Januscape
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-10
- Last reviewed
- 2026-07-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cloud-hosting, technology, government administration, finance, critical-infrastructure, any-multi-tenant-virtualization-user
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
A role-confusion logic flaw in Linux KVM's shared x86 shadow MMU (kvm_mmu_get_child_sp()) lets a malicious nested-virtualization guest force reuse of a shadow page under an incompatible role, corrupting KVM's reverse-map (rmap) state and creating a use-after-free in host kernel memory. Present since 2010 and undetected for roughly 16 years, it was actively exploited as a zero-day in Google's kvmCTF before responsible disclosure in June 2026; a public PoC demonstrates guest-to-host DoS/kernel panic and researchers confirmed potential for root-level arbitrary code execution on the host.
How CVE-2026-53359 ("Januscape") works
CVE-2026-53359, publicly named "Januscape," is a use-after-free vulnerability in the shadow paging implementation of Linux KVM's x86 MMU code (arch/x86/kvm/mmu/mmu.c), shared by both Intel VMX and AMD SVM backends. The root cause lives in kvm_mmu_get_child_sp(), the function KVM uses to fetch or reuse an existing shadow page when shadowing a guest's page tables. The reuse check compares only the guest frame number (GFN) of the candidate shadow page, without also verifying its role (role.word) -- specifically, whether the page represents a full guest page-table walk (role.direct = 0) or a directly-mapped split of a large page (role.direct = 1). These two roles are structurally incompatible, but the buggy logic allows a shadow page built for one role to be silently reused under the other.
When a guest constructs a scenario in which a single physical page is targeted first as part of a large (huge) page mapping and then, via a subsequent nested page fault, requested again as a 4KB page-table page at the same GFN, kvm_mmu_get_child_sp() returns the existing (wrong-role) shadow page rather than allocating a fresh one. This creates a divergence between where a leaf SPTE (shadow page-table entry) is recorded in KVM's reverse-mapping (rmap) structure and where teardown logic expects to find it (which assumes the direct/large-page GFN layout). When the mismatched page is later torn down -- during a nested page fault re-walk, dirty-logging scans, or an MMU-notifier-driven invalidation (e.g., triggered by memslot deletion or external page-table modification) -- cleanup code removes the wrong rmap entry and frees the underlying kvm_mmu_page while a stale sptep (shadow PTE pointer) still references it. Later host code that walks that GFN dereferences the freed shadow-page memory, producing a kernel use-after-free. Freed slots are subsequently overwritten with SHADOW_NONPRESENT_VALUE, and on many kernels the corruption is caught by KVM's internal WARN/BUG integrity assertions, causing an immediate kernel panic (denial of service). Security researchers assessed that, absent those internal safety checks, the same primitive is exploitable for arbitrary code execution at host kernel (root) privilege -- a full guest-to-host virtual machine escape.
The flaw requires only a guest-controlled kernel module capable of constructing nested page tables (L1-hypervisor-in-L2-guest style workloads, or a guest exercising nested EPT/NPT shadowing) -- no cooperation from host userspace VMM code, no privileged guest capability beyond ordinary /dev/kvm nested-virtualization access, and no host-side misconfiguration beyond having nested virtualization enabled. This makes it directly relevant to multi-tenant cloud platforms (e.g., AWS, Google Cloud) that expose nested virtualization to untrusted tenant workloads, CI/build farms running attacker-influenced VM images, and any research or hosting environment where /dev/kvm nested mode is reachable by less-trusted code.
The underlying buggy pattern was introduced by kernel commit 2032a93d66fa in 2010 and persisted through 16 years of enterprise kernel generations. A closely related, narrower issue in the same subsystem -- CVE-2026-46113, where KVM reused a shadow page built for the wrong GFN -- was patched earlier (commit 0cb2af2ea66a) but did not close this wrong-role reuse path; Januscape is a distinct defect requiring a separate fix. Independent security researcher V4bel reported Januscape to security@kernel.org on 2026-06-12. KVM maintainers Paolo Bonzini and Sean Christopherson developed and merged the upstream fix (commit 81ccda30b4e8) into mainline on 2026-06-19, adding a role.word equality check (spte_to_child_sp(*sptep)->role.word == role.word) alongside the existing GFN comparison. CVE-2026-53359 was formally assigned on 2026-07-04, and the coordinated-disclosure embargo lifted on 2026-07-06, at which point V4bel's proof-of-concept and technical write-up were published; the PoC demonstrates the DoS/kernel-panic path (cross-architecture, differing only in Intel EPT vs. AMD NPT encoding), while a reported full privilege-escalation exploit chain has not been publicly released, reportedly due to memory-layout alignment complexity required for reliable exploitation. Prior to public disclosure, the bug was independently discovered and exploited as a zero-day inside Google's kvmCTF bug-bounty/CTF competition environment, confirming real-world weaponization ahead of the coordinated fix.
Backported fixes have landed across multiple stable branches (6.1.177+, 6.6.144+, 6.12.95+, 6.18.38+, 7.1.3+, 7.2-rc1+). As of the July 7, 2026 disclosure, distro/rebootless-patch coverage was uneven: RHEL 10, Oracle Linux 10, Rocky Linux 10, AlmaLinux 10, Debian 13, Ubuntu 22.04, and Proxmox VE 7/8 had mainline-feed rebootless patches; Ubuntu 24.04 was in a testing feed; Enterprise Linux 8/9 (notably RHEL/EL9), Debian 11/12, Ubuntu 18.04/20.04, and Oracle UEK6/UEK7 remained in development, leaving a meaningful patch gap on widely deployed enterprise kernels immediately post-disclosure.
MITRE ATT&CK techniques used in TL-2026-1189
Collection
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Initial Access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
Execution
T1203 Exploitation for Client Execution
Defense Evasion
T1211 Exploitation for Stealth
Impact
T1489 Service Stop; T1499 Endpoint Denial of Service; T1565 Data Manipulation
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
privilege-escalation
defense-impairment
Affected products and versions in CVE-2026-53359 ("Januscape")
- Linux Kernel — Linux Kernel KVM (x86, arch/x86/kvm/mmu/mmu.c)
Vulnerable versions: 2.6.36; up to but not including 6.1.177; up to but not including 6.6.144; up to but not including 6.12.95; up to but not including 6.18.38; up to but not including 7.1.3
Fixed in: 6.1.177; 6.6.144; 6.12.95; 6.18.38; 7.1.3; 7.2-rc1 - Canonical — Ubuntu
Vulnerable versions: Ubuntu 18.04; Ubuntu 20.04; Ubuntu 24.04 (patch in testing feed)
Fixed in: Ubuntu 22.04 (mainline rebootless patch available) - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: RHEL 8; RHEL 9 (patch in development as of 2026-07-07)
Fixed in: RHEL 10 (mainline rebootless patch available) - Debian — Debian GNU/Linux
Vulnerable versions: Debian 11; Debian 12 (patch in development as of 2026-07-07)
Fixed in: Debian 13 (mainline rebootless patch available) - Oracle — Oracle Linux
Vulnerable versions: Oracle Linux with UEK6/UEK7 (patch in development)
Fixed in: Oracle Linux 10 - Rocky Enterprise Software Foundation / AlmaLinux Foundation — Rocky Linux / AlmaLinux
Fixed in: Rocky Linux 10; AlmaLinux 10 - Proxmox — Proxmox VE
Fixed in: Proxmox VE 7; Proxmox VE 8
Remediation for CVE-2026-53359 ("Januscape")
Patches
- Upstream mainline fix: commit 81ccda30b4e8 (adds role.word comparison to kvm_mmu_get_child_sp())
- Related companion fix: commit 0cb2af2ea66a for CVE-2026-46113 (wrong-GFN reuse) -- required in addition to, not instead of, the Januscape fix
- Stable backports available for kernel 6.1.177+, 6.6.144+, 6.12.95+, 6.18.38+, 7.1.3+, 7.2-rc1+
Immediate actions
- Disable nested virtualization on hosts that cannot yet be patched: verify /sys/module/kvm_intel/parameters/nested and /sys/module/kvm_amd/parameters/nested and set nested=0 where feasible
- Restrict or audit access to /dev/kvm and nested-virtualization capability for untrusted tenants, CI runners, and research/build hosts
- Inventory running kernel versions (uname -r) and cross-reference against the fixed version list to prioritize patch rollout
- Treat any guest suspected of triggering KVM kernel panics/WARN/BUG traces referencing shadow MMU or rmap code as a potential host-compromise incident requiring forensic review
Workarounds
- Disable nested virtualization (kvm_intel.nested=0 / kvm_amd.nested=0) on unpatched hosts exposed to untrusted guests
- Restrict guest kernel-module loading and nested EPT/NPT-capable workloads to trusted tenants only until patched
Longer-term hardening
- Apply vendor/distro kernel updates as they land for kernels still in development (EL8/EL9, Debian 11/12, Ubuntu 18.04/20.04, Oracle UEK6/UEK7)
- Deploy rebootless kernel live-patching (e.g., KernelCare or equivalent) on multi-tenant nested-virtualization fleets to close the exposure window without downtime
- Add host-level EDR/kernel telemetry alerting on KVM shadow-MMU integrity WARN/BUG events and unexpected VM host kernel panics
- Segment/limit nested-virtualization-capable hosts away from general untrusted multi-tenant workloads where nested virt is not a business requirement
CVEs associated with CVE-2026-53359 ("Januscape")
CVE-2026-53359
Weaknesses (CWE) in CVE-2026-53359 ("Januscape")
CWE-416
Timeline of CVE-2026-53359 ("Januscape")
- Buggy shadow-page reuse logic introduced into Linux KVM via commit 2032a93d66fa, beginning ~16 years of undetected exposure across enterprise kernel generations.
- Januscape independently discovered and actively exploited as a zero-day inside Google's kvmCTF bug-bounty/CTF program prior to coordinated public disclosure (exact date not specified in sources).
- Security researcher V4bel reports the Januscape vulnerability to security@kernel.org.
- Companion fix for the related CVE-2026-46113 (wrong-GFN shadow-page reuse, commit 0cb2af2ea66a) merged to mainline alongside the Januscape fix.
- KVM maintainers Paolo Bonzini and Sean Christopherson merge the fix (commit 81ccda30b4e8, adding role.word comparison to kvm_mmu_get_child_sp()) into the mainline Linux kernel.
- CVE-2026-53359 formally assigned by NVD/MITRE.
- Vulnerability details posted to the oss-security mailing list.
- Coordinated-disclosure embargo lifts; V4bel publishes proof-of-concept and technical write-up demonstrating the guest-triggered DoS/kernel-panic path on both Intel EPT and AMD NPT.
- Distro/rebootless-patch coverage assessed as uneven: RHEL 10, Oracle Linux 10, Rocky Linux 10, AlmaLinux 10, Debian 13, Ubuntu 22.04, and Proxmox VE 7/8 have mainline rebootless patches; Ubuntu 24.04 in testing feed; EL8/EL9, Debian 11/12, Ubuntu 18.04/20.04, and Oracle UEK6/UEK7 remain in development.
- Multiple security outlets (Cyber Security News, CyberPress, Dark Web Informer, Daily Security Review, The Cyber Express, Corgea, TuxCare) publish technical analyses naming the flaw "Januscape" and detailing kvmCTF zero-day exploitation.
Sources cited for CVE-2026-53359 ("Januscape")
- 16-Year-Old Linux KVM Vulnerability ("Januscape") Actively Exploited as Zero-Day
- 16-Year-Old Linux KVM Vulnerability Allows Malicious Guests to Corrupt Host Kernel Memory
- CVE-2026-53359 Detail - NVD
- A Long-Lived KVM Bug Resurfaces: Shadow Paging Use-After-Free in the Linux Kernel (CVE-2026-53359)
- CVE-2026-53359 Januscape: 16-Year KVM Flaw Enables VM Escape
- CVE-2026-53359
- CVE-2026-53359: Januscape Linux KVM Flaw Enables VM Escape
- CVE-2026-53359: Januscape turns KVM shadow-page role confusion into Linux guest-to-host escape
- Januscape CVE-2026-53359 KVM Guest Escape - the shadow paging bug that kept coming back
- In the Linux kernel, the following vulnerability has been resolved: CVE-2026-53359
- CVE-2026-53359 | Ubuntu Security
- oss-security mailing list disclosure
Threats related to CVE-2026-53359 ("Januscape")
- CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host
- CVE-2026-46215: Linux Kernel DRM GEM_CHANGE_HANDLE Use-After-Free Local Root Privilege Escalation
- Linux Kernel act_pedit Partial Copy-on-Write Page-Cache Corruption Local Privilege Escalation (CVE-2026-46331, "pedit COW")
- Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude Code
- CVE-2026-23111: Linux Kernel nf_tables Use-After-Free Enables Local Privilege Escalation and Container Escape
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
Detection coverage for TL-2026-1189
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1189 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.