KVM Shadow MMU Use-After-Free CVE-2026-53359 Enables Cross-Architecture VM Escape After 16 Years Dormant

The defect resided in KVM's shadow page table handling for 16 years until commit 81ccda30b4e8 merged on June 19. Researcher Hyunwoo Kim demonstrated full VM escape in Google kvmCTF, showing corruption of host kernel shadow page state from a guest. Exploitation yields host kernel panic for DoS across co-located tenants or root RCE to seize the hypervisor and all nested guests. On RHEL the flaw is reachable by unprivileged users for local privilege escalation. Cloud providers exposing nested virtualization face the highest exposure because guest root is standard on rented instances. The same binary flaw affects both Intel and AMD MMU paths, marking the first documented KVM escape with that reach. Related kernel weaknesses such as Dirty Frag can be chained when initial guest access is limited.