🚨 CVE-2026-53359 — Januscape

Linux KVM Shadow Paging Use-After-Free (Guest-to-Host Escape)

Januscape is a Linux Kernel KVM vulnerability caused by a Use-After-Free (UAF) condition in the x86 Shadow MMU. Under vulnerable configurations, a malicious guest can corrupt host memory, leading to host crashes and potentially breaking VM isolation.

---

📌 Overview

📖 Description

The vulnerability exists within KVM's legacy shadow paging implementation.

An earlier security fix validated the Guest Frame Number (GFN) but failed to verify the shadow page role before reusing an existing kvm_mmu_page.

This allows incompatible shadow pages to be reused, leaving stale reverse-mapping (rmap) entries after memory has already been freed.

Subsequent MMU operations may dereference freed memory, resulting in a Use-After-Free condition that can corrupt the host kernel.

⚙️ Technical Root Cause

Guest modifies page mapping
        │
        ▼
Shadow page reused
without validating role
        │
        ▼
Stale rmap entry remains
        │
        ▼
Shadow page freed
        │
        ▼
Later MMU operation
dereferences freed memory
        │
        ▼
Use-After-Free

😨 Kernel Panic

[  123.456789] BUG: unable to handle page fault for address: ffff8881xxxxxxxx
[  123.456789] #PF: supervisor read access in kernel mode
[  123.456789] #PF: error_code(0x0000) - not-present page
[  123.456789] CPU: 3 PID: 1234 Comm: poc_3 Tainted: G           OE
[  123.456789] RIP: 0010:kvm_mmu_page_get_gfn+0xXX/0xXX [kvm]
...
[  123.456789] Call Trace:
[  123.456789]  pte_list_remove+0xXX/0xXX [kvm]
[  123.456789]  kvm_mmu_zap_all_fast+0xXX/0xXX [kvm]
[  123.456789]  kvm_mmu_notifier_invalidate_range+0xXX/0xXX [kvm]
...
[  123.456789] Kernel panic - not syncing: Fatal exception
[  123.456789] ---[ end Kernel panic - not syncing: Fatal exception ]---

🎯 Potential Impact

• Host Kernel Panic (DoS)
• Hypervisor Memory Corruption
• Guest-to-Host Isolation Violation
• Possible Privilege Escalation
• Increased risk in multi-tenant virtualization environments

The official kernel fix addresses the shadow page reuse logic by ensuring page roles are validated before reuse.

🖥️ Affected Systems

Potentially affected environments include:

• Linux KVM Hosts
• Intel x86 Virtualization
• AMD x86 Virtualization
• Nested Virtualization Deployments
• Cloud Infrastructure using KVM

The vulnerable path is primarily associated with shadow paging, which can be exercised when nested virtualization is used.

🔍 Exploitation

Current public information indicates:

• ✅ Public denial-of-service PoC available
• ✅ Research disclosure published
• ⚠️ Researcher reports a guest-to-host escape exploit, though the public release primarily includes a DoS demonstration.

🛡️ Mitigation

• Update to a Linux kernel containing the upstream fix.
• Apply vendor kernel security updates.
• Disable nested virtualization where it is not required.
• Restrict untrusted guest workloads on unpatched hosts.

🔬 Detection

Administrators should:

• Audit Linux kernel versions.
• Monitor kernel crash logs (dmesg, journalctl).
• Track KVM-related security advisories.
• Validate that vendor backports include the official patch.

📚 References

• NVD Advisory
• Linux Kernel Security Fix
• oss-sec Disclosure
• Vendor Security Advisories

⚠️ Disclaimer

This repository is intended solely for cybersecurity education, defensive research, incident response, and vulnerability awareness.

No offensive tooling or exploit code is included.