Critical Linux kernel vulnerability CVE-2026-53359 (Januscape)

CVE-2026-53359 (Januscape) is a critical vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) virtualization subsystem. Caused by a Use-After-Free (UAF) flaw in the Shadow MMU mechanism, it allows an attacker with access to a guest virtual machine to break isolation between the guest and the host. In certain scenarios, successful exploitation may lead to arbitrary code execution on the host or cause a denial-of-service (DoS) condition.

Why is this vulnerability dangerous?

If successfully exploited, an attacker may:

• break isolation between the guest virtual machine and the host;
• execute arbitrary code on the host (under certain conditions);
• corrupt kernel memory;
• cause a denial-of-service (DoS) on the physical host.

Exploitation generally requires the ability to execute code inside a guest virtual machine.

Affected systems

The vulnerability affects vulnerable Linux kernel versions using KVM on the x86 architecture and may be present in various Linux distributions until security updates are installed. Affected distributions include:

• Ubuntu
• Debian
• Rocky Linux
• AlmaLinux
• Fedora
• Red Hat Enterprise Linux (RHEL)

Checking your kernel version

To find out the current kernel version, run the following command on your VPS/DS:

uname -r

Mitigating the vulnerability

Install the latest security updates, including the updated Linux kernel.

Ubuntu / Debian

sudo apt update
sudo apt upgrade

Rocky Linux / AlmaLinux / RHEL

sudo dnf update

For older versions:

sudo yum update

After installing the updated kernel, reboot your server:

sudo reboot

After installing the updates and rebooting, the system will use the new kernel with the latest security patches provided by your distribution's developer.

Verify the system is running the updated kernel. After the reboot, check the kernel version again:

uname -r

The reported version should match the updated kernel.

What to do if there is no patch?

You can apply mitigation. This doesn't completely solve the problem, but it will reduce the attack success rate until a kernel patch is released for your OS. An example of disabling nested virtualization is below. Be sure to check the recommendations for your OS, as they may differ.

# unload modules
sudo rmmod kvm_amd ; sudo rmmod kvm_intel
# disable nested virtualization
echo 'options kvm_amd nested=0' | sudo tee /etc/modprobe.d/nested.conf
echo 'options kvm_intel nested=0' | sudo tee -a /etc/modprobe.d/nested.conf

# load module again
sudo modprobe kvm_amd ; sudo modprobe kvm_intel