New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

Vulnerability Overview

Zapscape is a new Linux kernel vulnerability tracked as CVE-2026-64561. It could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests.

The flaw affects KVM/x86's shadow memory management unit (MMU), which manages shadow page tables used for nested guest memory translation. Security researcher Hyunwoo Kim, who disclosed the bug, said the demonstrated exploit path can run commands on the host with kernel, or root, privileges.

Exploit Requirements

The required L1 kernel privilege usually means guest root. In addition:

• Intel systems require both EPT page-walk length 4 and 5 to be exposed to the L1 guest.
• AMD systems have no equivalent condition.

Technical Details

Zapscape is a stale-root check ordering flaw in KVM's shadow-MMU bookkeeping that can lead to a use-after-free. During guest-triggered page fault handling, KVM can reclaim MMU pages and invalidate the shadow MMU root page still being used by the fault-handling path. Because the path does not check the root again, KVM can continue under the invalidated root.

In a technical write-up, Kim described the issue as a use-after-free in the recursive zap path used when KVM reclaims shadow pages. KVM checked whether the current root was stale before making more MMU pages available. Reclaim could then invalidate that same root, but KVM continued the fault path and created child shadow pages under it. Those child pages inherited the invalid state from the parent and were still placed on KVM's active MMU page list. Later cleanup could attach the same list link to two lists at once, then free the page while stale list references remain, creating a dangling link and post-free write.

Proof of Concept

Kim's public proof-of-concept uses that primitive to build a full chain that creates a root-owned file named /Zapscape on the host running the vulnerable KVM.

• The proof-of-concept targets AMD nested SVM/NPT on Linux 7.1.3.
• Kim recommends running it under QEMU TCG for safe testing.
• QEMU is not the vulnerable component; Kim said the bug lives in in-kernel KVM and is triggered independently of QEMU's emulation.

Kim's August 6 write-up includes a public proof-of-concept, but it does not claim the flaw has been exploited in the wild. Kim also described it as "not a weaponized exploit that runs immediately" in cloud environments, saying real-world use would require moving the L1 actions into a guest kernel module and adapting the exploit to the host kernel configuration and memory backend.

Affected Versions and Vendor Status

The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases, including:

• 6.6.148
• 6.12.101
• 6.18.42
• 7.1.6
• 7.2-rc5

Red Hat assigned a preliminary CVSS score of 7.0 in its advisory and classified the issue as CWE-825, or expired pointer dereference.

Package status depends on each Linux vendor's tracker, not only upstream version strings. Red Hat cautions that its packages often carry backported fixes without rebasing to a new upstream version.

As of August 6, 2026, Debian's tracker listed bullseye, bookworm, and trixie kernel packages, including their security repositories, as vulnerable. It also listed forky as vulnerable and sid as fixed at 7.1.6-1.

Disclosure Timeline

According to the disclosure timeline:

• July 11, 2026: Kim reported the issue to se******@kernel.org.
• July 21, 2026: A patch was posted and merged.
• August 1, 2026: The issue was submitted to the linux-distros list under a five-day embargo.
• August 4, 2026: CVE-2026-64561 was assigned.
• August 6, 2026: Public disclosure followed.

The Fix

The fix, merged as commit 2abd5287f083, moves the stale-root check after make_mmu_pages_available(). If reclaim invalidates the current root, KVM now restarts the fault with RET_PF_RETRY instead of continuing to map or fetch under the invalid root.

Related Research

The disclosure follows Kim's earlier KVM work, including Januscape (CVE-2026-53359), a separate KVM/x86 shadow-MMU issue covered by The Hacker News in July, and ITScape (CVE-2026-46316), a KVM/arm64 escape published in June.