A guest VM on KVM is not a clean containment boundary here. Once an attacker has root inside the VM, the broken shadow MMU code can let them corrupt host bookkeeping and cross into the hypervisor, so “it’s just a guest” is the wrong triage.
The flaw is CVE-2026-53359, a use-after-free in Linux KVM’s shadow MMU on x86. It works on both Intel and AMD, has sat in the kernel for 16 years, and was demonstrated as a zero-day in Google’s kvmCTF; mainline patches are now propagating through downstream distributions.
That gives this a wider operational footprint than a single disclosed bug. Multi-tenant clouds, hosting providers, and anyone exposing nested virtualization need to treat patch lag as part of the exposure, because a guest-root compromise can still become host compromise across every VM on the same machine.