16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

Januscape (CVE-2026-53359) is a long-standing use-after-free in KVM's shadow MMU that allows a guest VM (with root and nested virtualization enabled) to corrupt host shadow-page state, reliably panic hosts via a public PoC, and—per the researcher—may be weaponized into full host code execution; fixes were merged into mainline kernels on June 19, 2026 with stable backports published on July 4, 2026 and vendors releasing downstream updates.