KVM exploit CVE-2026-53359 Januscape, hypervisor crash with guest root potential

AnthonySmith · July 8

Happy patching day everyone.

https://nvd.nist.gov/vuln/detail/CVE-2026-53359

Bit of a scary sounding one, my impression is that this is probably (for now) one of those ones where the effort is massive to exploit and to actually get root from a guest you have to calculate the displaced atoms from a gravitational wave while standing on 1 leg eating lemons.... But as with the batch of local privilege escalation exploits, it has existed for 10 years undetected.

So let's hope this does not bring a wave of similar findings and daily patching.

Basically if you have nested KVM enabled for guests, your hypervisors are vulnerable.

No exploit in the wild yet I think, but I am sure that will change.

I am exploring live patching for TierHive because frankly I don't want to reboot everything, but if I must, I will.

Please... Don't become a trend.

mizzik · July 8

Fixed in Debian

https://security-tracker.debian.org/tracker/CVE-2026-53359

AnthonySmith · July 8

I was wrong there is a POC out there, so... Bad

tentor · July 8

Works only if nested virtualization is enabled

AnthonySmith · July 8

@tentor said:
Works only if nested virtualization is enabled

Yep, I think that's pretty standard now.

WSS · July 8

Qemu CPU Uber Allies

tulipyun · July 8

Why not just delete this post and pretend nothing ever happened?

SpeedBus · July 8

@AnthonySmith said: I am exploring live patching for TierHive because frankly I don't want to reboot everything, but if I must, I will.

KernelCare has patches out for it already, https://blog.cloudlinux.com/januscape-cve-2026-53359-mitigation-and-kernel-update-on-cloudlinux/

tentor · July 8

@SpeedBus said:

@AnthonySmith said: I am exploring live patching for TierHive because frankly I don't want to reboot everything, but if I must, I will.

KernelCare has patches out for it already, https://blog.cloudlinux.com/januscape-cve-2026-53359-mitigation-and-kernel-update-on-cloudlinux/

No patches for AlmaLinux 9 yet :(

AnthonySmith · July 8

@SpeedBus said:

@AnthonySmith said: I am exploring live patching for TierHive because frankly I don't want to reboot everything, but if I must, I will.

KernelCare has patches out for it already, https://blog.cloudlinux.com/januscape-cve-2026-53359-mitigation-and-kernel-update-on-cloudlinux/

oh god:

Januscape is a KVM vulnerability, so the obvious question is “we don’t run guests, are we exposed?” On CloudLinux 8, 9, and 10 the answer is usually yes. Those platforms ship /dev/kvm world-accessible by default, so any unprivileged local user (a shell account, a compromised site, a rogue process) can open the device, create a throwaway VM, and trigger the bug to crash the host, without your server ever being a hypervisor. The guest-to-host escape is the more severe path. The local-user path is the more common one on shared hosting.

The next few months/years are going to be fun.

Edit: /dev/kvm should not be world accessible anyway as standard (on debian at least) so I guess this is not so much of an issue, I also checked ubuntu 24 LTS, also not world accessible so as no root escalation POC has been posted and again, it sounds like you have to do a special incantation to get it, this might be a lot of noise about nothing.

Maybe someone who uses an rhel base can confirm /dev/kvm status.

Edit again: Yeah it is an issue in rhel base only, probably worth panel distributors to enforce this as standard as part of the deployment or at least flag it to the installer, tagging @VirtFusion, just a suggestion.

AnthonySmith · July 8

No I am wrong, ignore most of the above haha, that only applies to local access. I misunderstood the access method.

Advin · July 8

We scheduled reboots on all of our nodes, and so have a few other providers, to apply the patches.

KernelCare might work, but we use Proxmox and KernelCare stopped providing patches for Proxmox so it's not possible for us to use it (plus, I don't have full faith in KernelCare).

There is a PoC for a DoS but not a privilege escalation from my understanding. I was unable to replicate the DoS in PVE though.

AnthonySmith · July 8

@Advin said: There is a PoC for a DoS but not a privilege escalation from my understanding. I was unable to replicate the DoS in PVE though.

I would not be at all surprised if Proxmox handles things differently and is not impacted might be worth reaching out to them first or via community channels for comment.

cservers · July 8

We have acknowledged the bug, patched it, and staged a restart.

I'm also closely monitoring the evolution of this - which is chaotic as of the present moment: Debian 12 doesn't have the fix, only Debian 13 got it, as far as I've seen; Ubuntu doesn't seem to have it just yet, the page for the CVE doesn't reflect it apparently.

On the RHEL world, AlmaLinux once again being perfect and having it on EL8-EL10 just like RHEL, Oracle patched 9 and 10, and Rocky Linux apparently being the worst because there's no patch yet launched. A post on their own forum about this CVE even mentions 1/2 weeks for these patches to arrive, which honestly surprised me.

There's a very good reason EagleKey was coded having Debian 13 and AlmaLinux 10 in mind and that has fortunately proved to be a correct design decision today, so I'm happy.

Tiago

AnthonySmith · July 8

@AnthonySmith said:

@Advin said: There is a PoC for a DoS but not a privilege escalation from my understanding. I was unable to replicate the DoS in PVE though.

I would not be at all surprised if Proxmox handles things differently and is not impacted might be worth reaching out to them first or via community channels for comment.

yep just did some reading, seems no one managed to get the POC to impact a pve kernel, they have patched it anyway, but I would guess there are enough changes already present that the POC is not hitting the pve kernel in the same way.

AnthonySmith · July 8

@Advin said:
We scheduled reboots on all of our nodes, and so have a few other providers, to apply the patches.

KernelCare might work, but we use Proxmox and KernelCare stopped providing patches for Proxmox so it's not possible for us to use it (plus, I don't have full faith in KernelCare).

There is a PoC for a DoS but not a privilege escalation from my understanding. I was unable to replicate the DoS in PVE though.

Just got your email, are you suspending and resuming or just stopping guest domains?

Advin · July 9

@AnthonySmith said:

@Advin said: There is a PoC for a DoS but not a privilege escalation from my understanding. I was unable to replicate the DoS in PVE though.

I would not be at all surprised if Proxmox handles things differently and is not impacted might be worth reaching out to them first or via community channels for comment.

They released an updated kernel to patch it: https://forum.proxmox.com/threads/are-there-mitigations-available-for-cve-2026-53359-januscape.184874/

@AnthonySmith said:

@Advin said:
We scheduled reboots on all of our nodes, and so have a few other providers, to apply the patches.

KernelCare might work, but we use Proxmox and KernelCare stopped providing patches for Proxmox so it's not possible for us to use it (plus, I don't have full faith in KernelCare).

There is a PoC for a DoS but not a privilege escalation from my understanding. I was unable to replicate the DoS in PVE though.

Just got your email, are you suspending and resuming or just stopping guest domains?

All hypervisors (incl. guest virtual machines) will be safely shut down and then started again.

cservers · July 9

On our end all machines are now rebooted and updated with the patches for these exploits. Nested virtualization continues to be available.

KVM exploit CVE-2026-53359 Januscape, hypervisor crash with guest root potential

Comments