CVE-2026-64561

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 0.27%
EPSS Percentile: 19.44%
CISA KEV: Not listed

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published: 04-Aug-2026 14:16
Last Modified: 20-Oct-2026 04:17
EPSS Date: 2026-10-25
CWE: CWE-362

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 26-Oct-2026 02:22
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Zapscape is a Linux KVM/x86 shadow-MMU vulnerability, tracked as CVE-2026-64561, that can let an attacker with kernel-level privileges inside an L1 guest VM escape to the host and run code as root. Zapscape KVM Flaw Could Let Guest Root Escape to Linux Host

People (1)

MITRE ATT&CK (2)

Vendors (4)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.