An attacker with kernel privileges inside an L1 guest VM can escape KVM isolation and run code on the host, according to the public disclosure of CVE-2026-64561. The vulnerability — dubbed "Zapscape" by its finder — is a shadow memory-management flaw in KVM/x86 that becomes dangerous when nested virtualization is exposed to untrusted guests.
CVE-2026-64561: scope, scores, and affected kernels
The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases, naming specific releases that contain the upstream fix: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Red Hat published a preliminary advisory assigning a CVSS score of 7.0 and classifying the issue as CWE-825 (expired pointer dereference). Debian's tracker, as of August 6, 2026, showed bullseye, bookworm, and trixie kernel packages (including their security repositories) as vulnerable; forky was listed as vulnerable and sid as fixed at 7.1.6-1.
How the Zapscape shadow-MMU bug leads to host code execution
Security researcher Hyunwoo Kim described Zapscape as a stale-root check ordering flaw in KVM's shadow-MMU bookkeeping that can create a use-after-free. During guest-triggered page-fault handling, KVM may reclaim MMU pages and invalidate the shadow-MMU root page while that same root is still in use by the fault-handling path. Because the code did not re-check the root before continuing, KVM could complete the fault path under an invalidated root.
Kim's technical write-up frames the condition as a use-after-free in the recursive zap path used when KVM reclaims shadow pages: KVM initially checks whether the current root is stale before making more MMU pages available, but reclaim can invalidate that root. KVM then continued the fault handling, creating child shadow pages under the invalid parent. Those child pages inherited the invalid state and were placed on KVM's active MMU page list. Subsequent cleanup could attach the same list link to two lists simultaneously and free the page while stale references remained, producing a dangling link and enabling a post-free write primitive.
Kim used that primitive in a public proof-of-concept to build a full chain that creates a root-owned file named /Zapscape on the host. He said the demonstrated exploit path can run commands on the host with kernel, or root, privileges.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAttack prerequisites and practical limits
The vulnerability requires kernel privileges inside an L1 guest — typically guest root — in order to trigger the escape. On Intel systems an extra condition must be met: both EPT page-walk length 4 and 5 need to be exposed to the L1 guest. The disclosure notes AMD has no equivalent condition; the provided proof-of-concept targets AMD nested SVM/NPT on Linux 7.1.3.
Kim cautioned the public proof-of-concept is "not a weaponized exploit that runs immediately" in cloud environments. He outlined practical adaptation steps that would be necessary for real-world use: moving the L1 actions into a guest kernel module and tailoring the exploit to the host kernel configuration and memory backend. For safe testing he recommends running the POC under QEMU TCG; Kim emphasised that QEMU itself is not the vulnerable component and that the bug lives in in-kernel KVM and is triggered independently of QEMU's emulation.
Patch, commit details, and disclosure timeline
The upstream fix was merged as commit 2abd5287f083. The change moves the stale-root check to after make_mmu_pages_available(); if reclaim invalidates the current root, KVM now restarts the fault with RET_PF_RETRY instead of continuing to map or fetch under the invalid root. Administrators running KVM hosts that expose nested virtualization to untrusted guests are urged to update to a fixed stable kernel or to install vendor packages that backport the patch.
Kim reported the issue to security@kernel.org on July 11, 2026. A patch was posted and merged on July 21. The issue was submitted to the linux-distros list on August 1 under a five-day embargo. CVE-2026-64561 was assigned on August 4 and public disclosure followed on August 6.
What this means for KVM hosts, cloud operators, and Linux administrators
- KVM hosts: If you expose nested virtualization to untrusted guests, apply the fixed stable kernel or a vendor backport; the attack path demonstrated can lead to host root execution.
- Cloud operators: The exploit is not presented as immediately weaponized for cloud-scale abuse, but any environment that permits L1 guest kernel privileges and nested virtualization exposure should assess whether those configurations are necessary and ensure timely patching.
- Linux distributors and maintainers: Package status will vary by vendor tracker; Red Hat warns that production packages may carry backported fixes without rebasing to a new upstream version, so operators must consult vendor advisories rather than relying solely on upstream version strings.
Zapscape follows other recent KVM disclosures from Kim, including Januscape (CVE-2026-53359) and ITScape (CVE-2026-46316). The concrete mitigation is straightforward in principle — deploy the merged patch or vendor backport — but the disclosure underscores how subtle ordering issues in complex kernel subsystems can yield high-impact privileges escapes when nested virtualization is exposed to untrusted code.
Original reporting: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html
