CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected role
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.
INFO
Published Date :
July 4, 2026, 12:17 p.m.
Last Modified :
July 22, 2026, 7:07 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to incorporate the fix.
- Ensure shadow paging role mismatches are handled.
- Verify rmap entries are correctly removed.
- Prevent stale pointers to freed memory.
Public PoC/Exploit Available at Github
CVE-2026-53359 has a 21 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53359.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53359 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53359
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
KVM KernelCare + Januscape (CVE-2026-53359) verification & mitigation scripts
Shell
Panduan mitigasi Januscape (CVE-2026-53359) AlmaLinux 9.5 production-safe + scripts
Shell CSS HTML Python
A 16-year-old bug in the Linux kernel lets a rented VM break out and attack the host it runs on. Intel and AMD alike. Januscape is a use-after-free vulnerability in the KVM code that has been sitting there since 2010.
None
Shell
Security research 2026: Android, Linux, ESP32, and offensive security
CVE-2026-53359漏洞补丁
C Makefile Python
None
Shell Makefile Nix CSS HTML
None
Shell Makefile Nix CSS HTML
Linux 内核升级指南 - 修复 CVE-2026-53359
Zero-downtime livepatch for CVE-2026-53359 (Januscape), a guest-to-host escape vulnerability in the KVM/x86 shadow MMU.
Shell Go Makefile C
CVE-2026-53359
CVE-2026-53359 - Draft
Makefile C
pull CVE to JSON from red hat.
Python
Look for possible escape vectors from a container
aws azure cicd devsecops docker kubernetes kubernetes-security cve-scanning kernel-hardening kernel-security container-security linux linux-kernel
Shell
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53359 vulnerability anywhere in the article.
-
The Cyber Express
CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities (KEV) catalog after reports confirmed active zero-da ... Read more
-
The Cyber Express
The Cyber Express Weekly Roundup: Campus Cyberattack, Januscape VM Escape, Router Backdoors, UniFi Flaw, and Wireshark Security Updates
Enterprise infrastructure is increasingly under pressure as attackers and researchers alike expose weaknesses across the technology stack. This week, a confirmed university cyberattack, a critical Lin ... Read more
-
The Cyber Express
Ubiquiti Fixes Critical CVE-2026-50746 and Multiple UniFi OS Vulnerability Flaws
Ubiquiti has released security updates to address several critical security flaws, led by CVE-2026-50746, a maximum-severity UniFi OS vulnerability with a CVSS score of 10.0. Published in Security Adv ... Read more
-
The Cyber Express
CERT Warns of Unpatched Tenda Firmware Backdoor Allowing Admin Access
The CERT Coordination Center (CERT/CC) has disclosed a critical security issue affecting multiple Tenda networking devices. Tracked as CVE-2026-11405, the vulnerability stems from an undocumented back ... Read more
-
The Cyber Express
Wireshark 4.6.7 Fixes 12 Security Issues Across SSH, IEEE 802.11, Catapult DCT2000 and Other Protocols
The latest Wireshark 4.6.7 maintenance release addresses twelve security vulnerabilities that could affect users analyzing network traffic. Since packet captures processed in Wireshark pass through nu ... Read more
-
Ars Technica
Google pays $250K for Linux vulnerability allowing guest VM escapes
A Linux vulnerability that allows untrusted virtual machines to gain root access to host machines is one of two high-severity flaws to surface this week in the open source operating system. The vulner ... Read more
-
The Cyber Express
Januscape Flaw in Linux KVM’s MMU Code Enables VM Escape on Intel and AMD
A newly disclosed Linux kernel vulnerability, CVE-2026-53359, dubbed Januscape, has exposed a critical weakness in the Linux Kernel-based Virtual Machine (KVM) hypervisor. The flaw resides in the shad ... Read more
-
security.nl
Nieuw Linux-lek laat aanvaller uit guest VM ontsnappen en host overnemen
Een nieuwe kwetsbaarheid in de Linux-kernel maakt het mogelijk voor aanvallers in een guest virtual machine (VM) om code op de onderliggende host uit te voeren en die zo over te nemen. Er zijn imiddel ... Read more
-
The Hacker News
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-202 ... Read more
The following table lists the changes that have been made to the
CVE-2026-53359 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.36 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.38 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.1.3 Added Reference Type kernel.org: https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864 Types: Patch Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/07/06/7 Types: Mailing List -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 18, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 08, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53359', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-07T00:00:00+00:00'} -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jul. 06, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/07/06/7 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2032a93d66fa282ba0f2ea9152eeff9511fa9a96', 'lessThan': 'b1337aae5e194324e4810d561764e7793f8b3864', 'versionType': 'git'}, {'status': 'affected', 'version': '2032a93d66fa282ba0f2ea9152eeff9511fa9a96', 'lessThan': '9291654d69e08542de37755cebe4d5b02c3170d1', 'versionType': 'git'}, {'status': 'affected', 'version': '2032a93d66fa282ba0f2ea9152eeff9511fa9a96', 'lessThan': '2ad3afa40ac6aa340dada122f9abfa46c0a6eb35', 'versionType': 'git'}, {'status': 'affected', 'version': '2032a93d66fa282ba0f2ea9152eeff9511fa9a96', 'lessThan': '5e470998a23e4c3d89ed24e8172cb22747e61efa', 'versionType': 'git'}, {'status': 'affected', 'version': '2032a93d66fa282ba0f2ea9152eeff9511fa9a96', 'lessThan': '1ae7d5a6db6c190ce183e3098ca0e0846e14d462', 'versionType': 'git'}, {'status': 'affected', 'version': '2032a93d66fa282ba0f2ea9152eeff9511fa9a96', 'lessThan': '81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.36'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.36', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free. Added Reference https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462 Added Reference https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35 Added Reference https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa Added Reference https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb Added Reference https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1 Added Reference https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864