A 16-year-old vulnerability in the **Linux kernel**, dubbed **Januscape**, has been disclosed, allowing attackers to escape a virtual machine and execute arbitrary code on the host. This guest-to-host escape flaw, tracked as **CVE-2026-53359**, stems from a use-after-free weakness within the shadow MMU emulation of **KVM/x86**, the kernel-based virtual machine designed for x86 and x86_64 (AMD64) processor architectures. **Januscape** remained hidden in the **Linux kernel** for approximately 16 years before being patched in June 2026. It was reportedly utilized as a zero-day exploit in **Google**'s kvmCTF vulnerability reward program (VRP). ### Impact on Multi-Tenant Cloud Environments Successful exploitation grants attackers with root access inside a guest virtual machine (a common default in public cloud instances) the ability to execute code as root on the host. This could lead to a complete takeover of all other guest VMs running on the same host or even a crash of the host kernel, effectively taking all other tenants' virtual machines offline. Security researcher **Hyunwoo Kim**, who discovered the flaw, described **Januscape** as the first guest-to-host exploit that can be triggered on both **Intel** and **AMD** processor architectures, making it a distinct threat to multi-tenant public cloud environments such as **Google Cloud** and **Amazon Web Services**. "With guest-side actions alone, an attacker can compromise the host that runs their VM," **Kim** explained. "For example, an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE)." ### Broader Privilege Escalation Risks On some **Linux** distributions, such as **Red Hat Enterprise Linux (RHEL)**, where `/dev/kvm` is world-writable, unprivileged attackers can also exploit **CVE-2026-53359** to reliably gain root permissions on unpatched devices.  *Januscape demo (**Hyunwoo Kim**)* **Kim** has published a technical write-up and a proof-of-concept exploit capable of triggering a host kernel panic. He stated that a full guest-to-host escape exploit will not be released for the foreseeable future. ### Patching and Chaining Vulnerabilities Administrators running **KVM/x86** hosts that accept multi-tenant guests are urged to confirm that patch commit `81ccda30b4e8` has been applied to their host kernel to secure against these attacks. In May 2026, **Kim** also disclosed **Dirty Frag**, a **Linux** local privilege escalation flaw that chains **xfrm-ESP** (**CVE-2026-43284**) and **RxRPC** (**CVE-2026-43500**) page-cache write vulnerabilities to achieve root access on major distributions, including **Ubuntu**, **Red Hat Enterprise Linux**, **CentOS Stream**, and **Fedora**. **Kim** noted that attackers without guest root access on a target device could chain the **Dirty Frag** and **Januscape** flaws to achieve full system compromise.