Zapscape is a Linux KVM/x86 shadow-MMU vulnerability, tracked as CVE-2026-64561, that can let an attacker with kernel-level privileges inside an L1 guest VM escape to the host and run code as root. The issue affects systems with nested virtualization exposed to untrusted guests, and the upstream fix has already been merged for affected Linux kernels. #Zapscape #CVE-2026-64561 #KVM #KVM/x86
Keypoints
- Zapscape can let a privileged L1 guest escape KVM isolation and execute code on the host.
- The flaw is a stale-root check ordering bug in KVM’s shadow-MMU bookkeeping.
- The bug can trigger a use-after-free during guest page-fault handling and MMU page reclamation.
- Intel systems need EPT page-walk lengths 4 and 5 exposed, while AMD has no equivalent condition.
- The fix moves the stale-root check after make_mmu_pages_available() and restarts with RET_PF_RETRY if needed.
Read More: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html