A critical Linux kernel vulnerability, Januscape (CVE-2026-53359), has been disclosed affecting the Linux KVM/x86 memory management subsystem. This vulnerability may allow a malicious virtual machine to escape to the host, or on CloudLinux 8/9/10 systems where /dev/kvm is accessible, allow an unprivileged local user to crash the host or potentially gain root privileges.
We recommend all CloudLinux administrators apply the mitigation immediately and upgrade to a patched kernel as soon as possible.
Temporary Mitigation (Recommended Immediately)
For servers that DO NOT run KVM virtual machines (most shared hosting servers)
Unload the KVM modules and prevent them from loading again:
# Intel CPU
sudo modprobe -r kvm_intel kvm
# AMD CPU
sudo modprobe -r kvm_amd kvm
# Prevent KVM from loading on boot
printf 'install kvm_intel /bin/false\ninstall kvm_amd /bin/false\n' \
| sudo tee /etc/modprobe.d/disable-kvm.conf
Verify mitigation:
lsmod | grep kvm
ls /dev/kvm
The first command should return no output, and /dev/kvm should no longer exist.
For KVM Hypervisors (Servers Running Virtual Machines)
Restrict access to /dev/kvm:
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0660"' | sudo tee /etc/udev/rules.d/65-kvm.rules
sudo udevadm control --reload-rules
sudo udevadm trigger /dev/kvm
Note: This only mitigates the local-user attack path. Hypervisors must still update to a patched kernel or use KernelCare for complete protection.
Install Patched Kernel
CloudLinux 8
yum update 'kernel*' --enablerepo=cloudlinux-updates-testing -y
reboot
CloudLinux 7 Hybrid (CL7h)
yum update 'kernel*' --enablerepo=cl7h_beta -y
reboot
CloudLinux 9
dnf install -y https://repo.almalinux.org/almalinux/9/extras/x86_64/os/Packages/almalinux-release-testing-9-2.el9.noarch.rpm
dnf update 'kernel*'
reboot
dnf config-manager --disable almalinux-testing
CloudLinux 10
dnf install -y https://repo.almalinux.org/almalinux/10/extras/x86_64/os/Packages/almalinux-release-testing-10-2.el10.x86_64.rpm
dnf update 'kernel*'
reboot
dnf config-manager --disable almalinux-testing
CloudLinux 8/9 LTS (TuxCare ELS)
yum update kernel-lts -y
reboot
KernelCare Users
Testing feed:
kcarectl --update --prefix test
Stable feed:
kcarectl --update
Verify the Patch
Check your running kernel:
uname -r
KernelCare users can verify both fixes have been applied:
kcarectl --patch-info | grep -E 'CVE-2026-53359|CVE-2026-46113'
We strongly recommend applying the mitigation immediately and updating to the latest patched kernel at the earliest maintenance window. Shared hosting providers should treat this as a high-priority security update, even if they do not intentionally run virtual machines, as CloudLinux 8/9/10 expose /dev/kvm by default.
Thursday, July 9, 2026
