Zapscape Flaw Allows KVM Guest Escape to Linux Host
A newly disclosed Linux kernel vulnerability, CVE-2026-64561, permits attackers with kernel privileges within a guest VM to escape KVM isolation and execute code on the host system.
A critical vulnerability dubbed "Zapscape" has been discovered in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, potentially allowing a privileged attacker inside a guest virtual machine (VM) to break out of the hypervisor's isolation and execute arbitrary code on the host system. The flaw, tracked as CVE-2026-64561, specifically affects the KVM/x86 shadow memory management unit (MMU), which is responsible for managing memory access when nested virtualization is enabled.
Security researcher Hyunwoo Kim disclosed the vulnerability, demonstrating an exploit path that can achieve kernel-level or root privileges on the host. The risk is particularly pronounced in environments where nested virtualization is exposed to untrusted guest VMs. The upstream fix for this vulnerability has already been merged into the Linux kernel, and administrators are urged to update their KVM hosts to patched stable kernel versions or vendor packages that incorporate the fix.
To successfully exploit this vulnerability, an attacker typically needs kernel privileges within the L1 guest VM, which usually translates to root access. On Intel systems, specific hardware configurations are also required: both Extended Page Tables (EPT) page-walk lengths of 4 and 5 must be exposed to the L1 guest. AMD systems do not share this particular condition. The vulnerability arises from a flaw in KVM's shadow-MMU bookkeeping, specifically a "stale-root check ordering" issue that can lead to a use-after-free condition.
During the handling of guest-triggered page faults, KVM might reclaim MMU pages and invalidate the shadow MMU root page that is still actively being used by the fault-handling process. Because the KVM code does not re-verify the root's validity after reclamation, it can continue to operate under the now-invalidated root. This leads to the creation of child shadow pages that inherit the stale state of their parent.
These improperly managed child pages are then added to KVM's active MMU page list. A subsequent cleanup process can inadvertently attach the same list link to two different lists simultaneously. When the page is eventually freed, dangling list references remain, creating a post-free write vulnerability. Kim's proof-of-concept exploit leverages this primitive to construct a chain that results in the creation of a root-owned file named /Zapscape on the host system.
The proof-of-concept was developed targeting AMD nested SVM/NPT on Linux version 7.1.3. While Kim provided the exploit code, he noted that it is not a "weaponized exploit that runs immediately" in cloud environments. Real-world exploitation would likely require adapting the exploit to specific host kernel configurations and memory backends, and potentially moving the L1 actions into a guest kernel module.
According to the National Vulnerability Database, Linux kernel versions 5.9 and later are affected until they are patched. Specific fixed stable releases include 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Red Hat has assigned a preliminary CVSS score of 7.0 and classified the issue under CWE-825 (Expired Pointer Dereference). Package availability and patching status vary by Linux distribution vendor, with Debian's trackers indicating that several of its stable releases remain vulnerable as of the disclosure date.
The vulnerability was reported to security@kernel.org on July 11, 2026, with a patch merged on July 21. Following a standard disclosure timeline, it was shared with Linux distributions under embargo on August 1, received its CVE assignment on August 4, and was publicly disclosed on August 6. The fix, commit 2abd5287f083, ensures that the stale-root check occurs after make_mmu_pages_available(), and if the current root is invalidated, KVM restarts the fault process instead of continuing under the invalid state.