New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

A newly disclosed Linux kernel vulnerability, dubbed Zapscape and tracked as CVE-2026-64561, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The flaw affects KVM/x86’s shadow memory management unit (MMU), specifically in the handling of shadow page tables used for nested guest memory translation.

Security researcher Hyunwoo Kim, who discovered and disclosed the bug, demonstrated an exploit path that can run commands on the host with kernel or root privileges. The vulnerability is a stale-root check ordering flaw in KVM’s shadow-MMU bookkeeping, leading to a use-after-free. During guest-triggered page fault handling, KVM can reclaim MMU pages and invalidate the shadow MMU root page still in use, allowing the fault-handling path to continue under an invalidated root. This can result in a dangling list link and post-free write, which Kim’s proof-of-concept exploits to create a root-owned file named /Zapscape on the host.

The risk applies when nested virtualization is exposed to untrusted guests. Intel systems require both EPT page-walk length 4 and 5 to be exposed to the L1 guest; AMD has no equivalent condition. The upstream fix has been merged as commit 2abd5287f083, which moves the stale-root check after make_mmu_pages_available(). Administrators running KVM hosts that expose nested virtualization to untrusted guests should update to a fixed stable kernel or a vendor package that backports the patch.

The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases, including 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Red Hat assigned a preliminary CVSS score of 7.0 and classified the issue as CWE-825 (expired pointer dereference). Debian’s tracker listed bullseye, bookworm, trixie, and forky as vulnerable, with sid fixed at 7.1.6-1. Kim reported the issue on July 11, 2026, with public disclosure on August 6, 2026. The flaw has not been exploited in the wild, and Kim described the proof-of-concept as not a weaponized exploit that runs immediately in cloud environments.