Security researcher Hyunwoo Kim demonstrated a Linux kernel vulnerability, tracked as CVE-2026-53359 and named Januscape, as a zero-day in the Google kvmCTF bug bounty program. The vulnerability was patched in the mainline Linux kernel on June 19 via commit 81ccda30b4e8.

The vulnerability existed in the Linux kernel for 16 years prior to being patched. It impacts the shadow MMU code within the Linux Kernel-based Virtual Machine (KVM) hypervisor. This flaw allows code execution on the underlying host from a virtual machine and can be triggered on both Intel and AMD x86 architectures.

CVE-2026-53359 is a use-after-free flaw capable of corrupting the shadow page state of the host's kernel. On Red Hat Enterprise Linux (RHEL), an unprivileged user can exploit the vulnerability to escalate privileges to root.

Exploitation of the vulnerability requires root privileges on the guest machine. Root access is typically available by default when a user is allocated a VM instance on a public cloud. If root access is not available, an attacker could chain the flaw with a privilege escalation bug, such as Dirty Frag.

Kim explained the potential impact of the vulnerability. "For example, an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE)," Kim said. The Google kvmCTF bug bounty program offers up to $250,000 for full VM escape weaknesses.