Two high-severity vulnerabilities in the Linux kernel have come to light this week, both earning bug bounties from Google's kernelCTF programme. The more serious, dubbed "Januscape" and tracked as CVE-2026-53359, sits in KVM — the virtualisation component built into many Linux distributions — and lets an untrusted guest virtual machine break out and compromise the host it runs on. This matters because cloud platforms rely on that guest-host isolation to keep one customer's instance separate from the host and from other tenants; an attacker renting a single instance could crash the physical machine or seize root control over it and every other VM on it. Google awarded $250,000 for its disclosure.

Discovered by researcher Hyunwoo Kim, Januscape is a use-after-free flaw in the shadow MMU emulation that handles memory-address translation, and it had gone unnoticed for 16 years. It affects both AMD and Intel processors, requires the guest user to have root privileges, and works independently of QEMU, meaning it can affect custom virtualisation stacks. Kim has released a proof-of-concept that crashes the host, but is withholding a full guest-escape exploit until the "very distant future". The second flaw, "GhostLock" (CVE-2026-43499), is a 15-year-old use-after-free in the kernel's futex priority-inheritance code that lets a low-privilege user escalate to root; Nebula Security found it with its AI-assisted scanner Vega and received $92,337. Both bugs have been patched.