Key Takeaways
- CVE‑2026‑64561 (“Zapscape”) is a use‑after‑free flaw in KVM’s shadow‑MMU that lets a guest with kernel privileges escape nested‑VM isolation and run code on the host.
- The bug requires the L1 guest to have root (or equivalent kernel) access and, on Intel, the exposure of EPT page‑walk lengths 4 and 5; AMD does not have this extra condition.
- A public proof‑of‑concept creates a root‑owned file
/Zapscapeon the host, demonstrating a full escape chain, though the author notes it is not a weaponized, drop‑in exploit for cloud environments. - The fix (commit 2abd5287f083) moves the stale‑root check after
make_mmu_pages_available(), causing KVM to retry the page‑fault when the root is invalidated. - Patches have been merged into the upstream kernel; stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2‑rc5 (and later) contain the remedy. Vendors such as Red Hat, Debian, and others have issued backported fixes.
- Administrators who expose nested virtualization to untrusted guests should update to a patched kernel or apply the vendor‑provided backport as soon as possible.
Overview of the Zapscape Vulnerability
Zapscape (CVE‑2026‑64561) is a newly discovered Linux kernel weakness that affects the Kernel‑based Virtual Machine (KVM) hypervisor on x86 platforms. The flaw resides in KVM’s shadow memory‑management unit (MMU), which maintains shadow page tables used to translate memory accesses of nested (L2) guests. By exploiting a use‑after‑free condition in the shadow‑MMU bookkeeping, an attacker who already possesses kernel (root) privileges inside an L1 guest virtual machine can break out of KVM isolation and execute arbitrary code on the host system with the same privileges.
Conditions Required for Exploitation
To trigger Zapscape, the attacker must first gain root or equivalent kernel access within the L1 guest. On Intel processors, the vulnerability additionally requires that the guest be allowed to see both EPT page‑walk lengths 4 and 5; AMD systems do not impose this extra condition. When nested virtualization is exposed to untrusted guests—common in cloud, multi‑tenant, or development environments—these prerequisites can be satisfied, making the host susceptible to escape.
Technical Root Cause: Stale‑Root Check Ordering
The core issue lies in the ordering of a stale‑root check during the recursive “zap” path that KVM uses when reclaiming shadow MMU pages. During a guest‑triggered page‑fault handler, KVM may reclaim MMU pages and invalidate the current shadow‑MMU root while the fault‑handling routine is still using that root. Because the code does not re‑verify the root’s validity after reclamation, it continues to allocate child shadow pages under the now‑invalid root. Those child pages inherit the stale state and remain on KVM’s active MMU page list. Later cleanup can inadvertently link the same page to two lists simultaneously, free the page while stale references persist, and leave a dangling pointer that enables a post‑free write. This use‑after‑free primitive forms the foundation of the exploit.
From Primitive to Full Escape
Hyunwoo Kim, the researcher who disclosed the bug, demonstrated how the use‑after‑free can be chained to achieve a full host compromise. The proof‑of‑concept (PoC) crafts a sequence of page‑faults that manipulates the shadow‑MMU state, eventually allowing the attacker to write to host kernel memory. In the published PoC, this results in the creation of a file named /Zapscape owned by root on the host, proving that arbitrary host‑kernel code execution is possible. Kim emphasized that the PoC is not a ready‑to‑run weapon; real‑world deployment would require packaging the exploit as a guest kernel module and adapting it to the specific host kernel configuration and memory backend.
Disclosure Timeline and Patch Details
Kim reported the vulnerability to the kernel security mailing list ([email protected]) on July 11, 2026. A corrective patch was posted and merged into the mainline kernel on July 21, 2026. The issue was then submitted to the linux-distros mailing list on August 1 under a five‑day embargo, and CVE‑2026‑64561 was assigned on August 4. Public disclosure followed on August 6, 2026, accompanied by the PoC and a detailed technical write‑up.
The fix, identified as commit 2abd5287f083, relocates the stale‑root check to occur after the call to make_mmu_pages_available(). If the MMU reclamation invalidates the current root, KVM now returns RET_PF_RETRY, forcing the fault‑handling path to restart with a valid root instead of proceeding under the stale one. This simple reordering eliminates the use‑after‑free window.
Affected Versions and Vendor Responses
According to the National Vulnerability Database, all Linux kernels from version 5.9 onward are vulnerable until they incorporate the fixed stable releases. The patched stable branches include 6.6.148, 6.12.101, 6.18.42, 7.1.6, and the pre‑release 7.2‑rc5.
Red Hat assigned a preliminary CVSS score of 7.0 (high) and classified the flaw as CWE‑825 (expired pointer dereference). The company’s advisory notes that its distributions often carry backported patches without rebasing to a new upstream version, so users must consult Red Hat’s specific security errata.
As of August 6, 2026, Debian’s tracker listed the bullseye, bookworm, trixie, and forky kernel packages as vulnerable, while the sid branch was already fixed at version 7.1.6‑1. Other vendors (Ubuntu, SUSE, etc.) have similarly issued updates or backports; administrators should verify their distribution’s security pages for the exact package names.
Implications for Cloud and Virtualized Environments
Zapscape underscores the risk inherent in exposing nested virtualization to untrusted workloads. While the exploit requires guest‑level root privileges—a high bar in many hardened clouds—environments that allow privileged containers, custom kernels, or user‑controlled VM images may inadvertently satisfy the condition. The researcher warned that real‑world abuse would involve moving the exploit logic into a guest kernel module and tailoring it to the host’s memory layout, but the existence of a reliable primitive makes such adaptation feasible for determined attackers.
Recommendations for Administrators
- Update Kernels – Apply the latest stable kernel that includes commit 2abd5287f083 (6.6.148, 6.12.101, 6.18.42, 7.1.6, or later) or the vendor‑provided backport.
- Review Nested Virtualization Exposure – If possible, disable nested VM support for untrusted guests, or restrict it to trusted workloads only.
- Monitor Privilege Escalation Inside Guests – Strengthen guest hardening (e.g., SELinux/AppArmor, minimal capabilities) to reduce the likelihood of an attacker gaining root in the L1 VM.
- Apply Vendor Advisories – Consult Red Hat, Debian, Ubuntu, SUSE, and other distribution security bulletins for specific package names and installation instructions.
- Test in Isolation – When validating patches, use environments such as QEMU TCG (as suggested by the researcher) to avoid inadvertently exposing production hosts.
Connection to Prior KVM Findings
Zapscape follows a series of related KVM/MMU discoveries by the same researcher: Januscape (CVE‑2026‑53359) and ITScape (CVE‑2026‑46316). Each highlights different facets of KVM’s shadow‑MMU handling, reinforcing the importance of rigorous validation in the hypervisor’s memory‑management code paths. The cumulative effect of these findings has prompted broader scrutiny of KVM’s MMU reclamation logic across the Linux kernel community.
Conclusion
Zapscape reveals a subtle but critical use‑after‑free bug in KVM’s shadow‑MMU that can lead to host‑level code execution when nested virtualization is exposed to privileged guests. The flaw is now patched in recent kernel releases, and mitigation hinges on applying those updates and carefully managing nested VM exposure. By staying current with kernel patches and adhering to least‑privilege principles for guest workloads, administrators can substantially reduce the risk posed by this vulnerability.