Januscape: First Cross-Arch KVM Escape Exploit Goes Public

Hyunwoo Kim (@v4bel) has published Januscape (CVE-2026-53359), a KVM/x86 guest-to-host escape vulnerability that works on both Intel and AMD — a first for public exploit research. The bug is a use-after-free in the shadow MMU emulation, allowing a guest to corrupt the host kernel's shadow page table using only guest-side actions.

Impact

Two attack vectors exist. First, a malicious guest can panic the host kernel (DoS) or achieve arbitrary code execution with root privileges on the host, compromising all other VMs on the same physical machine. Second, on distributions where /dev/kvm is world-writable (e.g., RHEL with 0666 permissions), an unprivileged local user can chain this into a reliable LPE to root.

Affected Versions

The vulnerability spans from kernel commit 2032a93d66fa (2010-08-01) to 81ccda30b4e8 (2026-06-16) — roughly 16 years of dormant code. The fix is in the latter commit. Operators of multi-tenant x86 KVM hosts that expose nested virtualization should patch immediately.

Technical Details

The PoC triggers a race condition that hits a kernel BUG at arch/x86/kvm/mmu/mmu.c (pte_list_remove). It requires guest root to load a kernel module, but public cloud tenants typically have root on their instances. If guest root is unavailable, it must be chained with another LPE like Dirty Frag.

Unlike typical QEMU escape bugs, Januscape lives in in-kernel KVM, so it bypasses QEMU's emulation layer entirely. This makes it relevant even for large public clouds that use custom virtualization stacks. Arm64 KVM hosts are not affected by this specific CVE, but the author notes that the previously disclosed ITScape (CVE-2026-46316) still needs patching on arm64.

Januscape was successfully used as a 0-day in Google's kvmCTF competition.

The PoC is available on GitHub. The full escape exploit is withheld for now. If you run untrusted guests on x86 KVM with nested virtualization, apply the patch 81ccda30b4e8 without delay.