16‑Year‑Old KVM Use‑After‑Free Lets Guest VM Take Over Host
CVE‑2026‑53359, nicknamed Januscape, is a use‑after‑free bug in Linux KVM’s shadow MMU that has lingered for 16 years. It lets a malicious guest corrupt the host’s memory, enabling denial‑of‑service or full host compromise on both Intel and AMD x86 systems. Patch is available; update kernels now.