v4bel/januscape

Januscape is a research writeup and proof of concept for a security vulnerability in KVM, the virtualization technology built into the Linux kernel that lets one physical computer run multiple separate virtual machines. The vulnerability is tracked as CVE-2026-53359 and was discovered and publicly disclosed by security researcher Hyunwoo Kim after an agreed embargo period ended. Normally, a guest virtual machine is supposed to be isolated from the host computer running it, and from other guest machines sharing the same hardware. This vulnerability breaks that isolation. It is a use after free bug, a class of memory management error, located in a part of KVM called the shadow MMU, which handles how memory addresses are translated for guest machines. Using only actions available from inside a guest VM, an attacker can corrupt memory on the host machine. Depending on how it is used, this can crash the host and take down every other virtual machine sharing that physical server, or in the worst case let an attacker run code with full control on the host itself. What makes this bug notable is that it works on both Intel and AMD processors, rather than being limited to one, and it affects a wide range of Linux kernel versions going back roughly sixteen years. It was also used successfully against Google's own kvmCTF bug bounty program as a real world zero day exploit. The repository includes a proof of concept kernel module that a user can build and load inside a guest VM to trigger a crash on the host, along with a detailed technical writeup explaining exactly how the bug works. A complete exploit that fully takes over the host, rather than just crashing it, exists but is not included in this release. The README is explicit that this code is meant for authorized security testing only, not for use on systems you do not have permission to test. The project also answers common questions, such as noting that ARM based KVM hosts are not affected by this specific bug, and that anyone running a multi tenant KVM host should confirm the relevant kernel patch has been applied.