# CVE-2026-53359 ("Januscape") - 16-Year-Old Linux KVM Shadow MMU Use-After-Free Exploited as Zero-Day

> A role-confusion logic flaw in Linux KVM's shared x86 shadow MMU (kvm_mmu_get_child_sp()) lets a malicious nested-virtualization guest force reuse of a shadow page under an incompatible role, corrupting KVM's reverse-map (rmap) state and creating a use-after-free in host kernel memory. Present since 2010 and undetected for roughly 16 years, it was actively exploited as a zero-day in Google's kvmCTF before responsible disclosure in June 2026; a public PoC demonstrates guest-to-host DoS/kernel panic and researchers confirmed potential for root-level arbitrary code execution on the host.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1189
- **ID:** TL-2026-1189
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-53359, CVE-2026-46113

## Description

CVE-2026-53359, publicly named "Januscape," is a use-after-free vulnerability in the shadow paging implementation of Linux KVM's x86 MMU code (arch/x86/kvm/mmu/mmu.c), shared by both Intel VMX and AMD SVM backends. The root cause lives in kvm_mmu_get_child_sp(), the function KVM uses to fetch or reuse an existing shadow page when shadowing a guest's page tables. The reuse check compares only the guest frame number (GFN) of the candidate shadow page, without also verifying its role (role.word) -- specifically, whether the page represents a full guest page-table walk (role.direct = 0) or a directly-mapped split of a large page (role.direct = 1). These two roles are structurally incompatible, but the buggy logic allows a shadow page built for one role to be silently reused under the other.

When a guest constructs a scenario in which a single physical page is targeted first as part of a large (huge) page mapping and then, via a subsequent nested page fault, requested again as a 4KB page-table page at the same GFN, kvm_mmu_get_child_sp() returns the existing (wrong-role) shadow page rather than allocating a fresh one. This creates a divergence between where a leaf SPTE (shadow page-table entry) is recorded in KVM's reverse-mapping (rmap) structure and where teardown logic expects to find it (which assumes the direct/large-page GFN layout). When the mismatched page is later torn down -- during a nested page fault re-walk, dirty-logging scans, or an MMU-notifier-driven invalidation (e.g., triggered by memslot deletion or external page-table modification) -- cleanup code removes the wrong rmap entry and frees the underlying kvm_mmu_page while a stale sptep (shadow PTE pointer) still references it. Later host code that walks that GFN dereferences the freed shadow-page memory, producing a kernel use-after-free. Freed slots are subsequently overwritten with SHADOW_NONPRESENT_VALUE, and on many kernels the corruption is caught by KVM's internal WARN/BUG integrity assertions, causing an immediate kernel panic (denial of service). Security researchers assessed that, absent those internal safety checks, the same primitive is exploitable for arbitrary code execution at host kernel (root) privilege -- a full guest-to-host virtual machine escape.

The flaw requires only a guest-controlled kernel module capable of constructing nested page tables (L1-hypervisor-in-L2-guest style workloads, or a guest exercising nested EPT/NPT shadowing) -- no cooperation from host userspace VMM code, no privileged guest capability beyond ordinary /dev/kvm nested-virtualization access, and no host-side misconfiguration beyond having nested virtualization enabled. This makes it directly relevant to multi-tenant cloud platforms (e.g., AWS, Google Cloud) that expose nested virtualization to untrusted tenant workloads, CI/build farms running attacker-influenced VM images, and any research or hosting environment where /dev/kvm nested mode is reachable by less-trusted code.

The underlying buggy pattern was introduced by kernel commit 2032a93d66fa in 2010 and persisted through 16 years of enterprise kernel generations. A closely related, narrower issue in the same subsystem -- CVE-2026-46113, where KVM reused a shadow page built for the wrong GFN -- was patched earlier (commit 0cb2af2ea66a) but did not close this wrong-role reuse path; Januscape is a distinct defect requiring a separate fix. Independent security researcher V4bel reported Januscape to security@kernel.org on 2026-06-12. KVM maintainers Paolo Bonzini and Sean Christopherson developed and merged the upstream fix (commit 81ccda30b4e8) into mainline on 2026-06-19, adding a role.word equality check (spte_to_child_sp(*sptep)->role.word == role.word) alongside the existing GFN comparison. CVE-2026-53359 was formally assigned on 2026-07-04, and the coordinated-disclosure embargo lifted on 2026-07-06, at which point V4bel's proof-of-concept and technical write-up were published; the PoC demonstrates the DoS/kernel-panic path (cross-architecture, differing only in Intel EPT vs. AMD NPT encoding), while a reported full privilege-escalation exploit chain has not been publicly released, reportedly due to memory-layout alignment complexity required for reliable exploitation. Prior to public disclosure, the bug was independently discovered and exploited as a zero-day inside Google's kvmCTF bug-bounty/CTF competition environment, confirming real-world weaponization ahead of the coordinated fix.

Backported fixes have landed across multiple stable branches (6.1.177+, 6.6.144+, 6.12.95+, 6.18.38+, 7.1.3+, 7.2-rc1+). As of the July 7, 2026 disclosure, distro/rebootless-patch coverage was uneven: RHEL 10, Oracle Linux 10, Rocky Linux 10, AlmaLinux 10, Debian 13, Ubuntu 22.04, and Proxmox VE 7/8 had mainline-feed rebootless patches; Ubuntu 24.04 was in a testing feed; Enterprise Linux 8/9 (notably RHEL/EL9), Debian 11/12, Ubuntu 18.04/20.04, and Oracle UEK6/UEK7 remained in development, leaving a meaningful patch gap on widely deployed enterprise kernels immediately post-disclosure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1203 Exploitation for Client Execution
- T1611 Escape to Host
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1499 Endpoint Denial of Service
- T1489 Service Stop
- T1565 Data Manipulation
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1005 Data from Local System

## Sources

- [16-Year-Old Linux KVM Vulnerability ("Januscape") Actively Exploited as Zero-Day](https://cybersecuritynews.com/16-year-old-linux-kvm-vulnerability/)
- [16-Year-Old Linux KVM Vulnerability Allows Malicious Guests to Corrupt Host Kernel Memory](https://cyberpress.org/16-year-old-linux-kvm-vulnerability/)
- [CVE-2026-53359 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53359)
- [A Long-Lived KVM Bug Resurfaces: Shadow Paging Use-After-Free in the Linux Kernel (CVE-2026-53359)](https://darkwebinformer.com/a-long-lived-kvm-bug-resurfaces-shadow-paging-use-after-free-in-the-linux-kernel-cve-2026-53359/)
- [CVE-2026-53359 Januscape: 16-Year KVM Flaw Enables VM Escape](https://dailysecurityreview.com/resources/cve-2026-53359-januscape-16-year-kvm-flaw-enables-vm-escape/)
- [CVE-2026-53359](https://www.tenable.com/cve/CVE-2026-53359)
- [CVE-2026-53359: Januscape Linux KVM Flaw Enables VM Escape](https://thecyberexpress.com/cve-2026-53359-januscape/)
- [CVE-2026-53359: Januscape turns KVM shadow-page role confusion into Linux guest-to-host escape](https://corgea.com/research/cve-2026-53359-januscape-linux-kvm-vm-escape)
- [Januscape CVE-2026-53359 KVM Guest Escape - the shadow paging bug that kept coming back](https://tuxcare.com/blog/januscape-exposes-the-kvm-shadow-paging-bug-that-kept-coming-back/)
- [In the Linux kernel, the following vulnerability has been resolved: CVE-2026-53359](https://github.com/advisories/ghsa-wpw8-53h7-xqcq)
- [CVE-2026-53359 | Ubuntu Security](https://ubuntu.com/security/CVE-2026-53359)
- [oss-security mailing list disclosure](http://www.openwall.com/lists/oss-security/2026/07/06/7)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1189