A newly disclosed vulnerability in Linux's Kernel-based Virtual Machine (KVM) could allow an attacker with kernel-level control inside a nested virtual machine to break out of virtualization boundaries and execute code on the underlying host system under specific conditions.
Tracked as CVE-2026-64561 and dubbed Zapscape, the flaw affects KVM's x86 shadow memory management unit (MMU), a core component responsible for maintaining shadow page tables that translate memory between guest virtual machines and the host. Security researcher Hyunwoo Kim, who identified and disclosed the issue, demonstrated that the vulnerability can be leveraged to execute commands on the host with root privileges.
The issue has been addressed upstream, and administrators operating KVM environments that expose nested virtualization to untrusted virtual machines are advised to deploy patched kernel releases or vendor packages containing the backported fix.
Unlike conventional virtualization deployments where guest systems operate in isolation from the host, nested virtualization allows a virtual machine to function as a hypervisor itself. In this configuration, an L1 guest can create and manage additional virtual machines, commonly referred to as L2 guests. While this capability is widely used for cloud infrastructure testing, development environments, virtualization research, and continuous integration workloads, it also introduces additional complexity into memory management, making implementation flaws particularly impactful.
Zapscape requires an attacker to already possess kernel-level privileges inside an L1 guest, which generally translates to root access within that virtual machine. On Intel-based systems, exploitation additionally depends on exposing both Extended Page Table (EPT) page-walk lengths four and five to the L1 guest. AMD platforms do not impose this additional requirement.
At the heart of the vulnerability is a flaw in the ordering of stale-root validation within KVM's shadow MMU bookkeeping. The weakness results in a use-after-free condition, a class of memory safety bug in which software continues interacting with memory after it has already been released.
According to Kim's technical analysis, the issue occurs while KVM is servicing guest-triggered page faults. During this process, KVM may reclaim shadow MMU pages to free memory resources. That reclamation can invalidate the shadow MMU root page currently being used by the ongoing page-fault handling routine. However, because the fault-handling path fails to verify that the root remains valid after the reclamation step, execution continues using an object that has already become stale.
The researcher explained that the vulnerability originates within KVM's recursive "zap" path, which is responsible for reclaiming shadow MMU pages. Before additional MMU pages are made available, KVM performs an initial stale-root validation. The problem arises because the subsequent reclamation process can invalidate that same root after the check has already completed. Rather than restarting with a fresh and valid root, KVM proceeds to construct new child shadow pages beneath the invalid parent.
Those newly created child pages inherit the parent's invalid state while simultaneously being inserted into KVM's active MMU page list. During later cleanup operations, the same list entry can become attached to multiple linked lists simultaneously. Eventually, the affected page may be freed even though stale references continue pointing to it, leaving behind a dangling pointer and enabling writes to memory that should no longer be accessible.
Such memory corruption primitives can provide the foundation for privilege escalation and virtualization escape techniques, particularly when an attacker already controls a privileged guest operating system.
To demonstrate the vulnerability, Kim released a public proof-of-concept that exploits the bug to create a root-owned file named /Zapscape on the vulnerable Linux host, illustrating successful code execution beyond the guest boundary.
The proof-of-concept was developed against AMD nested virtualization using Secure Virtual Machine (SVM) and Nested Page Tables (NPT) on Linux 7.1.3. For safe experimentation, Kim recommends running the demonstration under QEMU's Tiny Code Generator (TCG) mode. However, the researcher emphasized that QEMU itself is not affected by the vulnerability. Instead, the flaw resides entirely within the Linux kernel's KVM implementation and can be triggered independently of QEMU's device emulation.
Although exploit code is publicly available, Kim cautioned that the demonstration should not be interpreted as an immediately deployable attack against production cloud infrastructure. In its current form, the proof-of-concept requires additional engineering before it could be adapted for real-world environments. Among other changes, portions of the L1 guest activity would need to be moved into a guest kernel module, while the exploit would also require customization for the target host's kernel configuration and memory management backend.
At the time of disclosure, no evidence had emerged indicating that CVE-2026-64561 had been exploited in active attacks.
The National Vulnerability Database lists Linux kernel versions beginning with 5.9 as affected until fixed stable releases became available, including versions 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5.
Security advisories note that administrators should not rely solely on upstream version numbers when assessing exposure. Many enterprise Linux distributions routinely backport security fixes into existing kernel packages without rebasing to newer upstream releases, making vendor advisories the authoritative source for determining whether individual systems have received the necessary patches.
Red Hat assigned the vulnerability a preliminary CVSS score of 7.0 and categorized it under CWE-825: Expired Pointer Dereference, reflecting the use-after-free behavior underlying the flaw.
Package availability also varies across Linux distributions. As of August 6, Debian's security tracker listed kernel packages for bullseye, bookworm, trixie, and forky, including their security repositories, as vulnerable, while sid had already incorporated the fix beginning with version 7.1.6-1.
The coordinated disclosure followed a structured timeline spanning several weeks. Kim privately reported the vulnerability to security@kernel.org on July 11, 2026. A corrective patch was proposed and merged on July 21 before being shared with the linux-distros security mailing list on August 1 under a five-day embargo. The vulnerability subsequently received the identifier CVE-2026-64561 on August 4, with public disclosure taking place on August 6.
The upstream patch, merged as commit 2abd5287f083, modifies KVM's page-fault handling sequence by moving the stale-root validation until after make_mmu_pages_available() completes. If memory reclamation invalidates the current shadow MMU root, KVM now abandons the active page-fault operation and restarts it using RET_PF_RETRY, preventing further memory mappings from being created beneath an invalid root and eliminating the conditions that produced the use-after-free.
Zapscape marks the latest addition to Kim's ongoing security research into Linux virtualization. Earlier this year, the researcher disclosed Januscape (CVE-2026-53359), which affected KVM/x86's shadow MMU, and ITScape (CVE-2026-46316), a separate guest escape vulnerability impacting KVM on Arm64 systems. Together, the disclosures continue to draw attention to the security challenges involved in protecting complex virtualization infrastructure that underpins modern cloud and enterprise computing environments.
.jpg "OpenAI and Anthropic AI Agents Crossed Testing Boundaries During Cybersecurity Evaluations")
.jpg)