Reported by 7 outlets

Timeline

1. original reporting

   A critical KVM guest escape (CVE-2026-89775) enables an LPE to gain root on Linux hosts. Patch this KVM guest escape vulnerability now. # KV

   securityonline.info · 27d ago · September 17th, 2026

   A critical KVM guest escape (CVE-2026-89775) enables an LPE to gain root on Linux hosts. Patch this KVM guest escape vulnerability now. # KV

   via Mastodon https://securityonline.info/kvm-guest-escape-cve-2026-89775/?utm_source=mastodon&utm_medium=jetpack_social

2. update from thehackernews.com

   16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

   thehackernews.com · 100d ago · July 6th, 2026

   The Hacker News reported on July 6, 2026, that researcher Hyunwoo Kim disclosed "Januscape" (CVE-2026-53359), a 16-year-old use-after-free in Linux KVM's shadow MMU affecting both Intel and AMD hosts. The article notes the bug was fixed in mainline on June 19, 2026 (commit 81ccda30b4e8) and that a public PoC triggers a reliable host panic. It also references Kim's earlier disclosures (Dirty Frag in May, ITScape/CVE-2026-46316 in June) and states the vulnerability was used as a zero-day in Google's kvmCTF program. The piece is directly relevant to the story cluster because the same researcher and the same embargo timeline link CVE-2026-89775 and CVE-2026-53359 in the events.

3. update from openwall.com

   Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359)

   openwall.com · 99d ago · July 6th, 2026

   Hyunwoo Kim's oss-security disclosure of a use-after-free in the KVM/x86 shadow MMU that lets guest-side actions alone corrupt the host kernel's shadow page and break guest-host isolation on Intel and AMD systems, latent for about 16 years and successfully used as a 0-day exploit in Google kvmCTF. The post notes /dev/kvm is world-writable (0666) on distributions such as RHEL, making it a reliable LPE, and links the mainline fix commit 81ccda30b4e8. This is the public July KVM escape 404 Media later tied to at least one of Meta's pre-launch Muse flaws. Date taken from the mailing list message header, converted from +0900.

4. update from securityweek.com

   CVE-2026-53359 "Januscape" — 16-Year-Old Linux KVM Flaw Enables VM Escape on Intel and AMD Systems

   securityweek.com · 99d ago · July 7th, 2026

   A use-after-free vulnerability in Linux's KVM hypervisor — dormant for 16 years — has been disclosed and patched. Tracked as CVE-2026-53359 and dubbed "Januscape," the flaw sits in the shadow MMU code shared across both Intel and AMD architectures, making it the first publicly known KVM exploit triggerable on both CPU families. Discovered by researcher Hyunwoo Kim (@v4bel) and demonstrated in Google's kvmCTF bug bounty program (up to $250,000), the vulnerability allows an attacker with root on a guest VM to corrupt the host kernel's shadow page state, leading to full host compromise. In a public cloud scenario, a single malicious guest could panic the host kernel (denial of service against all other tenants) or execute arbitrary code with host root privileges to take over the physical machine and all VMs on it. On RHEL-based distributions, the flaw can also be exploited by unprivileged local users for privilege escalation to root. Exploitation requires root on the guest (typically default on cloud VMs); if root is unavailable, it can be chained with a privilege escalation bug like Dirty Frag. Patched in mainline Linux on June 19 (commit 81ccda30b4e8). Cloud providers and Linux distribution maintainers should have patched; enterprises should verify their kernel versions are at or past the fix commit. Audit cloud VM fleets. If unpatched, restrict untrusted guest workloads and enable nested virtualization protections.

5. update from gbhackers.com

   Critical Linux KVM Flaw Enables Guest-to-Host Escape on ARM64 Systems

   gbhackers.com · 21d ago · September 22nd, 2026

   A critical vulnerability in the Linux Kernel-based Virtual Machine (KVM) for ARM64 systems could let attackers escape a virtual machine and gain read and write access to host kernel memory.

6. update from cyberpress.org

   Critical Linux KVM Flaw Lets Attackers Escape Virtual Machines and Gain Root Access

   cyberpress.org · 21d ago · September 22nd, 2026

   Security researcher Hyunwoo Kim disclosed the issue after an embargo coordinated through the Linux distribution security process expired. The vulnerability is especially significant for multi-tenant cloud environments, where an attacker with access to a guest virtual machine may be able to compromise the host system that runs it. Critical Linux KVM Flaw From there, the attacker could potentially access other workloads, virtual machines, and sensitive cloud infrastructure hosted on the same physical server. According to OpenWall , the vulnerability stems from a type-truncation issue involving the stage-1 page-table walk level in KVM/ARM64 . The truncation causes an internal size-computation function to return zero. In this code path, zero represents an “unknown” size. However, the Virtual Nested Control Register (VNCR) pseudo-translation lookaside buffer invalidation mechanism incorrectly treats the zero value as a legitimate size. This produces an empty invalidation range, meaning the required pseudo-TLB invalidation is skipped entirely.

7. mentioned by sekurak.pl

   Critical vulnerability in Linux KVM on ARM64. Under certain conditions an attacker can take control of the host [CVE-2026-89775]. The openwall.com portal is investigating.

   sekurak.pl · 16d ago · September 28th, 2026