Two Decades-Old Linux Kernel Flaws Let Attackers Seize Cloud Host Machines

A pair of critical Linux kernel vulnerabilities disclosed this week have sent ripples through the cloud security community, with one flaw allowing a rented cloud instance to be weaponized against an entire physical host machine and all virtual machines running on it. Both vulnerabilities are use-after-free memory corruption bugs, both grant root privileges to attackers who successfully exploit them, and both sat undetected in widely deployed Linux code for well over a decade before researchers finally surfaced them in 2025.

The more severe of the two, dubbed Januscape and tracked as CVE-2026-53359, lives inside KVM — the Kernel-based Virtual Machine subsystem built directly into the Linux kernel and used extensively across cloud providers including Google Cloud, AWS, and Azure-adjacent infrastructure. Researcher Hyunwoo Kim discovered that an attacker operating entirely from within a guest VM can corrupt the host kernel's shadow page tables, a data structure that assists in translating memory addresses between guest and host environments. The bug affects both AMD and Intel processor environments and exploits the guest-side component of the KVM stack, meaning it bypasses QEMU entirely — a critical detail that makes it effective even against cloud platforms running custom virtualization stacks. The flaw went undetected in the Linux kernel for 16 years.

Kim explained the real-world stakes bluntly: an attacker renting a single cloud instance could either crash the host kernel, taking down every co-tenant virtual machine on that physical server in a denial-of-service attack, or escalate further to execute arbitrary code with root privileges on the host itself, effectively seizing control of the entire physical machine and all its guests. Kim has published a proof-of-concept exploit that demonstrates a host crash triggered from inside the guest, and confirmed that a full escape exploit exists, though he stated it would not be released for the foreseeable future. Google awarded Kim $250,000 through its kernelCTF bug bounty program for the find.

The second vulnerability, GhostLock and tracked as CVE-2026-43499, was discovered by researchers at Nebula Security using Vega, the company's AI-assisted vulnerability scanner. This flaw resides in the Linux kernel's futex priority-inheritance subsystem — infrastructure dating back to 2011 that manages task scheduling priority to prevent urgent processes from being blocked by lower-priority operations. A race condition in a specific cleanup pathway leaves the kernel holding a stale pointer to freed and reused memory, which researchers at Nebula then chained into a full privilege escalation to root. GhostLock carries a severity score of 7.8 out of 10, and Google awarded Nebula $92,337 through the same kernelCTF program.

Both vulnerabilities have now received patches in the Linux kernel upstream, and distribution maintainers are expected to push those fixes to stable releases. Users and administrators running Linux-based systems — particularly those operating in cloud or multi-tenant environments — are advised to verify that their specific distribution has received and applied the relevant kernel updates, as patch propagation timelines vary widely across distributions such as Ubuntu, Debian, Red Hat, and others.