A Linux kernel vulnerability, tracked as CVE-2026-64561 and named Zapscape, could allow attackers to escape a KVM virtual machine and take control of its underlying Linux host with root privileges.
The issue affects KVM/x86, a virtualization technology that separates guest systems from the physical server. The flaw is especially serious for cloud providers and enterprises that run untrusted workloads.
Zapscape was discovered by security researcher Hyunwoo Kim, known as V4bel. It exists in KVM’s shadow memory management unit, or shadow MMU. It manages memory translations when nested virtualization is used.
Nested virtualization allows one virtual machine to run another virtual machine inside it. While useful for testing and cloud services, it creates a larger attack surface.
The vulnerability is a use-after-free bug in the recursive zap path used by KVM when reclaiming shadow pages. In simple terms, KVM can free a memory structure but later continue to use it.
Zapscape KVM Escape Grants Root Access
A malicious guest can trigger that unsafe condition from inside the guest. This can corrupt memory in the host kernel, breaking the security boundary that normally keeps a guest separate from its host.
A successful attack could have severe consequences. An attacker with kernel-level control in an L1 guest may execute commands on the KVM host as root.
That could allow data theft, service disruption, access to other virtual machines on the same server, or host control. In shared cloud environments, one compromised tenant instance could therefore put other customers at risk.
A proof-of-concept published on GitHub demonstrates the escape chain in a controlled QEMU TCG environment, resulting in a root-owned file on the host.
The researcher said it is not a ready-made cloud attack, but warned that adapting it to a real environment would not be difficult. Organizations should treat the availability of public exploits as an urgent patching signal.
The affected code was introduced in 2020 and was fixed upstream in Linux commit 2abd5287f083 on July 21, 2026. The patch changes the validation order in the shadow MMU fault path.
KVM now checks whether a root page became invalid after it makes MMU pages available. If the page was reclaimed, KVM retries the fault rather than continuing to use the invalid structure.
Risk is highest where nested virtualization is exposed to untrusted users. Guest root access is generally required for the documented escape route, which is common in infrastructure-as-a-service deployments.
Intel environments face an additional condition: both four-level and five-level EPT page-walk support must be exposed to the L1 guest. AMD systems do not have that stated condition.
Administrators should promptly install a vendor kernel containing the upstream fix and reboot affected KVM hosts. Until patching is complete, teams should disable nested virtualization for untrusted guests where operationally possible.
They should also restrict access to /dev/kvm, review host configurations, identify exposed multi-tenant systems, and monitor vendor advisories.
Zapscape shows that hypervisor patch management is essential: a single guest escape can undermine isolation across an entire server.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
