A local privilege escalation and VM escape vulnerability (CVE-2026-53359, dubbed Januscape) was disclosed on July 6, 2026, affecting the Linux kernel's KVM nested virtualization on Intel and AMD x86_64 systems. All Ubuntu releases are impacted. A proof-of-concept exploit exists that can crash a hypervisor host from a guest. Kernel patches are pending; in the meantime, the recommended mitigation is to disable nested virtualization by unloading the kvm_amd and kvm_intel modules and setting nested=0 in /etc/modprobe.d/. Cloud tenants using KVM-based providers with nested virtualization enabled are at risk from other tenants. Deployments without VMs may still be exposed via services like libvirt, lxd, or multipass if unprivileged users can access /dev/kvm.
