← Back to SecLog

Linux KVM flaw CVE-2026-53359 lets attackers escape virtual machines on Intel and AMD hosts

Updated: 2026.10.19 6D ago 5 sources
Zero-Days & CVEs
A newly disclosed Linux kernel bug can let an attacker break out of a virtual machine and take control of the underlying host system. The flaw, CVE-2026-53359, affects the shadow MMU (memory-management unit) code in Linux's Kernel-based Virtual Machine (KVM) hypervisor and is described as a use-after-free issue. Researcher Hyunwoo Kim demonstrated it in Google's kvmCTF, and the bug was patched upstream on June 19, 2026. It is notable for affecting both Intel and AMD x86 systems and posing particular risk to multi-tenant cloud environments using nested virtualization.
Why it matters: Organizations and cloud providers running Linux KVM hosts could face full host takeover from a compromised guest, putting other tenants and workloads at risk. Administrators should identify affected KVM hosts, apply the June 2026 kernel fix or vendor backports, and review exposure where untrusted VMs or nested virtualization are allowed.

Sources

Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking
2026.10.19 7% relevant
This is also a Linux KVM guest-host escape story, but it describes a different underlying event: CVE-2026-99999 ('PwnEscape') in Linux networking/checksum handling, not the earlier CVE-2026-53359 KVM escape flaw.
Security researcher claims to they found KVM guest-host escape flaw
2026.10.06 71% relevant
This appears to be follow-up reporting on a newly claimed KVM guest-host escape discovered through Vercel’s sandbox bounty program, adding public attribution to researcher Paulos Yibelo, Vercel’s confirmation that KVM is the affected hypervisor, and the likely Firecracker MicroVM context. However, the article does not provide a CVE or enough technical detail to prove it is the same flaw with certainty.
Security researcher claims they found KVM guest-host escape flaw
2026.10.06 54% relevant
This article may be an early report of the same underlying KVM guest-to-host escape issue, adding that researcher Paulos Yibelo and Vercel publicly claimed a KVM zero-day discovered through Vercel's Sandbox bounty program and that Firecracker MicroVMs appear to be involved, but it does not provide a CVE or enough technical detail to confirm the match.
New Januscape Linux flaw allows VM escape on Intel, AMD devices
Sergiu Gatlan 2026.07.07 98% relevant
This article is a direct report on the same Januscape vulnerability, adding plain-language impact details, confirmation it affected both Intel and AMD, the patch commit defenders should verify, and that a proof-of-concept causing host kernel panic was published while full guest-to-host exploit code was withheld.
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems
Ionut Arghire 2026.07.07 100% relevant
This article establishes a distinct new story around CVE-2026-53359 (Januscape), a newly disclosed cross-vendor Linux KVM VM-escape flaw with upstream patch details and cloud-impact context not covered by an existing tracked story.
← Back to all stories