Two high-severity Linux vulnerabilities surfaced this week — and one of them’s been hiding in the kernel for 16 years.
The big one is CVE-2026-53359, which researcher Hyunwoo Kim calls Januscape. It’s a KVM vulnerability that lets an untrusted guest VM break out and gain root access on the host machine. That’s a worst-case scenario for cloud providers — one tenant escaping their VM and getting access to every other VM on the same physical server.
How does it work? It’s a use-after-free bug in KVM’s shadow MMU emulation — the part that translates memory addresses between the host and the hypervisor. An attacker with root access inside a guest VM can trigger actions that corrupt the host’s shadow page table. From there, they can crash the host kernel (DoS) or execute code with root privileges on the host (full RCE).
The bug affects KVM on both AMD and Intel processors. It doesn’t depend on QEMU, so it works even in cloud environments with custom virtualization stacks. Kim released a proof-of-concept that crashes the host from inside a guest. The full escape exploit exists but won’t be released yet.
Google paid $250,000 through its kernelCTF program.
The second bug is CVE-2026-43499, dubbed GhostLock by Nebula Security researchers. It’s a privilege escalation vulnerability in the kernel’s futex priority-inheritance system — code that dates back to 2011. Nebula found it using Vega, an AI-assisted vulnerability scanner.
GhostLock lets a user with limited rights escalate to root. It’s another use-after-free — the cleanup code runs at the wrong time, the kernel trusts a stale pointer, and an attacker can chain that into full control. Severity rating: 7.8 out of 10. Google paid $92,337 for this one.
Both vulnerabilities have patches in the mainline Linux kernel. Users should check their distributions for updates.
