This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Linux fixes two vulnerabilities in the KVM module

Linux fixes two vulnerabilities in the KVM module of the Linux kernel for the x86 platform. The vulnerability (CVE-2026-53359), referred to as "Januscape", has been present in the kernel since 2010 (since version 2.6.36) and was demonstrated as a 0-day in Google kvmCTF [1]. For the vulnerability (CVE-2026-53359), a fix is already available in the official stable branches of the Linux kernel (including the 7.1, 6.18, 6.12, 6.6, 6.1, 5.15 and 5.10 series) [2] or in the Debian distribution (testing version trixie and unstable version sid) [3]. If an update is not possible, a workaround is to disable nested virtualization on the host by adding the parameters kvm_intel.nested=0 (for Intel) or kvm_amd.nested=0 (for AMD) to the kernel module configuration [4]. Debian releases and their fixed versions (CVE-2026-53360) [5]: bullseye - 5.10.223-1 bullseye (security) - 5.10.259-1 bookworm - 6.1.170-3 bookworm (security) - 6.1.176-1 trixie (security) - 6.12.95-1 forky - 7.0.13-1 sid - 7.1.3-1

Linux kernel (KVM) - LPE, DoS, ACE (CVE-2026-53359)
CVSS 8.8 (High)

An authenticated local attacker in a guest system can, in the case of nested virtualization, exploit a use-after-free flaw in the shadow MMU subsystem, where validation is missing during page recycling, and thereby escape to the host system, escalate their privileges without authorization and cause DoS or potentially execute arbitrary code [1]. A public DoS PoC is available [6].

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 4. 7. 2026.

Linux kernel (KVM) - (CVE-2026-53360)
CVSS 8.8 (High)

An authenticated local attacker in a guest system can, via specially crafted parameters of communication with the hypervisor, exploit a missing bounds check of allocated memory when processing page state change requests in the AMD secure encrypted subsystem, and thereby trigger out-of-bounds reads and writes in the host's heap memory, which leads to disclosure of system information, corruption of kernel structures or access to already freed memory [7].

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

By CESNET, z.s.p.o. Táňa Macháčková on 7. 7. 2026.

CESNET, z.s.p.o. Logo