Zapscape, a brand new Linux kernel vulnerability, might enable an attacker with kernel privileges inside an L1 visitor digital machine (VM) to flee KVM isolation and execute code on the host. The chance applies when nested virtualization is uncovered to untrusted visitors.
The flaw is tracked as CVE-2026-64561 and impacts KVM/x86’s shadow reminiscence administration unit (MMU), which manages shadow web page tables used for nested visitor reminiscence translation.
Safety researcher Hyunwoo Kim, who disclosed the bug, stated the demonstrated exploit path can run instructions on the host with kernel, or root, privileges.
The upstream repair has been merged, and directors working KVM hosts that expose nested virtualization to untrusted visitors ought to replace to a hard and fast secure kernel or a vendor bundle that backports the patch.
The required L1 kernel privilege normally means visitor root. Intel methods additionally require each EPT page-walk size 4 and 5 to be uncovered to the L1 visitor. AMD has no equal situation.
Zapscape is a stale-root verify ordering flaw in KVM’s shadow-MMU bookkeeping that may result in a use-after-free. Throughout guest-triggered web page fault dealing with, KVM can reclaim MMU pages and invalidate the shadow MMU root web page nonetheless being utilized by the fault-handling path. As a result of the trail doesn’t verify the foundation once more, KVM can proceed beneath the invalidated root.
In a technical write-up, Kim described the problem as a use-after-free within the recursive zap path used when KVM reclaims shadow pages. KVM checked whether or not the present root was stale earlier than making extra MMU pages obtainable. Reclaim might then invalidate that very same root, however KVM continued the fault path and created youngster shadow pages beneath it.
These youngster pages inherited the invalid state from the mother or father and have been nonetheless positioned on KVM’s lively MMU web page checklist. Later cleanup might connect the identical checklist hyperlink to 2 lists without delay, then free the web page whereas stale checklist references stay, making a dangling hyperlink and post-free write.
Kim’s public proof-of-concept makes use of that primitive to construct a full chain that creates a root-owned file named /Zapscape on the host working the susceptible KVM.
The proof-of-concept targets AMD nested SVM/NPT on Linux 7.1.3. Kim recommends working it beneath QEMU TCG for secure testing. QEMU isn’t the susceptible part. Kim stated the bug lives in in-kernel KVM and is triggered independently of QEMU’s emulation.
Kim’s August 6 write-up features a public proof-of-concept, but it surely doesn’t declare the flaw has been exploited within the wild. Kim additionally described it as “not a weaponized exploit that runs instantly” in cloud environments, saying real-world use would require transferring the L1 actions right into a visitor kernel module and adapting the exploit to the host kernel configuration and reminiscence backend.
The Nationwide Vulnerability Database lists Linux 5.9 and later as affected till fastened secure releases, together with 6.6.148, 6.12.101, 6.18.42, 7.1.6, and seven.2-rc5.
Pink Hat assigned a preliminary CVSS rating of seven.0 in its advisory and categorized the problem as CWE-825, or expired pointer dereference.
Package deal standing relies on every Linux vendor’s tracker, not solely upstream model strings. Pink Hat cautions that its packages typically carry backported fixes with out rebasing to a brand new upstream model.
As of August 6, 2026, Debian’s tracker listed bullseye, bookworm, and trixie kernel packages, together with their safety repositories, as susceptible. It additionally listed forky as susceptible and sid as fastened at 7.1.6-1.
In keeping with the disclosure timeline, Kim reported the problem to safety@kernel.org on July 11, 2026. A patch was posted and merged on July 21, the problem was submitted to the linux-distros checklist on August 1 beneath a five-day embargo, and CVE-2026-64561 was assigned on August 4. Public disclosure adopted on August 6.
The repair, merged as commit 2abd5287f083, strikes the stale-root verify after make_mmu_pages_available(). If reclaim invalidates the present root, KVM now restarts the fault with RET_PF_RETRY as a substitute of continuous to map or fetch beneath the invalid root.
The disclosure follows Kim’s earlier KVM work, together with Januscape (CVE-2026-53359), a separate KVM/x86 shadow-MMU concern lined by The Hacker Information in July, and ITScape (CVE-2026-46316), a KVM/arm64 escape revealed in June.
