Zapscape KVM Flaw Could Let Guest Root Escape to Linux Host
Summary
CVE-2026-64561 (“Zapscape”) is a KVM/x86 shadow-MMU flaw that may let a guest-root attacker escape an L1 VM when nested virtualization is exposed. The upstream fix is merged; the disclosure does not report in-the-wild exploitation.
Key points
- The stale-root check ordering flaw can cause a use-after-free during KVM shadow-MMU page reclamation and guest page-fault handling.
- Exploitation requires kernel-level privileges inside an L1 guest and nested virtualization exposed to an untrusted guest.
- On Intel, the L1 guest must have EPT page-walk lengths 4 and 5 exposed; the article says AMD has no equivalent condition.
- Researcher Hyunwoo Kim published a proof of concept that creates a root-owned file on the host; the disclosure does not claim in-the-wild exploitation.
- The upstream fix moves the stale-root check after make_mmu_pages_available() and retries the page fault if reclaim invalidates the root.
- Administrators should update to a fixed stable kernel or a vendor package containing the backported patch; package status varies by vendor.
Article Details
- Vulnerability Types
- Use-after-free
- Stale-root check ordering flaw
- Severity
- 7.0 (preliminary CVSS score assigned by Red Hat)
- Affected Versions
- Linux kernel 5.9 and later, before the applicable fix
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe flaw can be exploited from kernel-level privileges inside an L1 guest to run commands on the host with root privileges.T1611 · Escape to HostThe public proof-of-concept exploits the KVM flaw to escape an L1 guest VM and execute code on the Linux host.
CVE
People
Vendors
AMDIntel systems need EPT page-walk lengths 4 and 5 exposed, while AMD has no equivalent condition.DebianAs of August 6, 2026, Debian’s tracker listed bullseye, bookworm, and trixie kernel packages, including their security repositories, as vulnerable.IntelIntel systems need EPT page-walk lengths 4 and 5 exposed, while AMD has no equivalent condition.Red HatRed Hat assigned a preliminary CVSS score of 7.0 in its advisory and classified the issue as CWE-825, or expired pointer dereference.
Products
KVMZapscape is a Linux KVM/x86 shadow-MMU vulnerability, tracked as CVE-2026-64561, that can let an attacker with kernel-level privileges inside an L1 guest VM escape to the host and run code as root.LinuxZapscape is a Linux KVM/x86 shadow-MMU vulnerability, tracked as CVE-2026-64561, that can let an attacker with kernel-level privileges inside an L1 guest VM escape to the host and run code as root.