OVH force-patches KVM across tens of thousands of hosts | 16-year-old Januscape bug, ~1M VMs rebooted without notice
TL;DR
OVHcloud on July 21 disclosed its emergency KVM patching campaign for CVE-2026-53359 (Januscape) — tens of thousands of hypervisor hosts covering ~1 million VMs. Januscape is a 16-year-old KVM shadow-paging use-after-free bug allowing guest-to-host escape. OVH chose not to pre-notify customers and pushed the reboot directly.
OVHcloud on July 21 published a post-mortem — to patch CVE-2026-53359 (Januscape), it executed emergency KVM upgrades across tens of thousands of hypervisor hosts covering roughly 1 million virtual machines. The severity was so high that OVH decided not to pre-notify customers and pushed the reboot directly.
Januscape is a 16-year-old use-after-free bug in KVM's shadow-paging subsystem, publicly disclosed on July 7. An attacker inside a guest VM can trigger host-kernel shadow-page state corruption; the public PoC panics the host, and the researcher claims a separate unreleased exploit turns the same bug into full host code execution — meaning a single malicious VM can compromise the hypervisor and reach every other tenant on that host.
OVH's decision logic: this kind of kernel upgrade requires a host reboot and interrupts customer workloads, but coordinating maintenance windows across tens of thousands of customers is physically impossible. "Customers being notified couldn't have meaningfully prepared," OVH chose security > business continuity.
Execution hit hardware-level surprises — memory faults, BIOS issues, NIC issues, PSU issues — resolved by on-site engineers pulling boxes apart. OVH said the final failure rate was "very low, proportional to the engineering scale."
This is a rare "publicly admitted forced downtime" case in cloud infrastructure — AWS, GCP, Azure would use live-migration + staged reboots to hide the downtime; OVH wrote "no notification, hard upgrade" straight into the report. Refreshingly transparent.
Januscape's fix is in mainline Linux kernel 7.1.3, 6.18.38, 6.12.95 and other stable branches. Every self-hosted KVM environment should update now. No workaround.
via OVHcloud Blog / landiannews
Januscape is a 16-year-old use-after-free bug in KVM's shadow-paging subsystem, publicly disclosed on July 7. An attacker inside a guest VM can trigger host-kernel shadow-page state corruption; the public PoC panics the host, and the researcher claims a separate unreleased exploit turns the same bug into full host code execution — meaning a single malicious VM can compromise the hypervisor and reach every other tenant on that host.
OVH's decision logic: this kind of kernel upgrade requires a host reboot and interrupts customer workloads, but coordinating maintenance windows across tens of thousands of customers is physically impossible. "Customers being notified couldn't have meaningfully prepared," OVH chose security > business continuity.
Execution hit hardware-level surprises — memory faults, BIOS issues, NIC issues, PSU issues — resolved by on-site engineers pulling boxes apart. OVH said the final failure rate was "very low, proportional to the engineering scale."
This is a rare "publicly admitted forced downtime" case in cloud infrastructure — AWS, GCP, Azure would use live-migration + staged reboots to hide the downtime; OVH wrote "no notification, hard upgrade" straight into the report. Refreshingly transparent.
Januscape's fix is in mainline Linux kernel 7.1.3, 6.18.38, 6.12.95 and other stable branches. Every self-hosted KVM environment should update now. No workaround.
via OVHcloud Blog / landiannews
