Critical Linux kernel vulnerability CVE-2026-53359 (Januscape)

CVE-2026-53359 (Januscape) is a critical vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) virtualization subsystem. The Use-After-Free (UAF) flaw affects the Shadow MMU mechanism and may allow an attacker with access to a guest virtual machine to break isolation between the guest and the host. In certain scenarios, successful exploitation may lead to arbitrary code execution on the host or cause a denial-of-service (DoS) condition.

Why is this vulnerability dangerous?

If successfully exploited, an attacker may:

• break isolation between the guest virtual machine and the host;
• execute arbitrary code on the host (under certain conditions);
• corrupt kernel memory;
• cause a denial-of-service (DoS) on the physical host.

Exploitation generally requires the ability to execute code inside a guest virtual machine.

Affected systems

The vulnerability affects vulnerable Linux kernel versions using KVM on the x86 architecture and may be present in various Linux distributions until the relevant security updates have been installed, including:

• Ubuntu;
• Debian;
• Rocky Linux;
• AlmaLinux;
• Fedora;
• Red Hat Enterprise Linux (RHEL).

How to check your kernel version

Run the following command to determine the currently running kernel version:

uname -r

Then verify that your distribution has installed a kernel package containing the fix for CVE-2026-53359.

How to mitigate the vulnerability

Install the latest security updates, including the updated Linux kernel.

Ubuntu / Debian

sudo apt update
sudo apt upgrade

Rocky Linux / AlmaLinux / RHEL

sudo dnf update

or, on older versions:

sudo yum update

After installing the updated kernel, reboot the server:

sudo reboot

Ensure the system is running the updated kernel.

After the reboot, check the running kernel version again:

uname -r

The reported version should correspond to the updated kernel.