There’s a bug in the Linux kernel that’s been sitting there for 16 years. It’s called Januscape, and it lets attackers break out of a virtual machine and take over the host hypervisor. Yes, a VM escape — the kind of vulnerability that keeps cloud security engineers up at night.
Security researcher Hyunwoo Kim demonstrated it as a zero-day by triggering a use-after-free error in the shadow MMU code of Linux’s KVM hypervisor. It works on both Intel and AMD architectures.
A VM escape shatters the fundamental assumption of virtualization: that what happens in the guest stays in the guest. “A single compromised instance can grant root privileges over the server,” said Jason Soroko of Sectigo. From there, attackers can steal data, crash the host kernel, or compromise every other VM on that hardware.
The bug is tracked as CVE-2026-53359. It’s been in the Linux codebase since 2010 — 16 years of sitting there unnoticed. Why so long? Most deployments use hardware-assisted paging and skip the old shadow MMU code entirely. But nested virtualization — running a VM inside another VM — forces execution back through that path. Because the feature is optional, the code got minimal review for over a decade and a half.
Jacob Krell of Suzu Labs pointed out a bigger trend here. A $250,000 bug bounty got one researcher to find this. “AI-assisted code analysis is on track to do the same work across every neglected subsystem simultaneously,” he said. Expect more decade-old bugs to surface in the next 12 to 18 months as automated analysis reaches code human reviewers haven’t touched since it was written.
A patch is already available. Any organization running KVM should identify affected hosts and apply it immediately — especially in multi-tenant deployments where the risk is highest.
