When a critical bug threatens to let one cloud customer’s virtual machine crash everyone else’s, patching it fast matters more than patching it quietly. OVH just published an unusually detailed account of exactly how it handled that tradeoff.
The French cloud provider’s CISO, Julien Levrard, revealed this week how OVH scrambled to fix Januscape, officially tracked as CVE-2026-53359, a flaw in the Linux kernel’s KVM virtualization software. The bug let an attacker with root access inside a guest VM break out and execute code on the host machine itself, potentially crashing it or taking over every other VM running on the same hardware. For a cloud provider whose entire business rests on keeping tenant workloads isolated from each other, that’s about as bad as security bugs get.
OVH ruled out the easier fixes first. Disabling nested virtualization wasn’t viable because the company relies on it to shift VMs between physical hosts and can’t tell which tenants actually need it. Live patching risked instability. Gradually migrating VMs to patched hosts would have taken months, leaving the fleet exposed the entire time. So OVH went with the blunt option: backport the fix into its production Debian build and reboot every affected host, tens of thousands of them running roughly a million VMs, whether customers liked it or not.
The company deliberately chose Sydney as its testing ground first, partly because it’s one of OVH’s smaller regions and partly because the time difference meant European teams could handle the rollout during their own business hours while Sydney sat at a quiet stretch.
The engineering got genuinely intricate. Rather than simply rebooting hosts rack by rack, OVH built co-location graphs for every customer project spread across multiple hosts, ensuring no two hosts running the same customer’s instances ever went down in the same window.
Even with that care, the rollout hit real problems: some VMs failed to restart, some hosts suffered data corruption during forced shutdowns, and OpenStack’s APIs threw hours of errors at one site after traffic spiked to ten times normal levels. Roughly 20 to 30 hosts out of 6,000 didn’t recover on the first night, some needing hardware fixes as basic as new CMOS batteries.
Levrard called the overall effort a success given the scale involved, but admitted OVH needs to improve its process before the next emergency patch inevitably arrives.
