Zapscape: KVM Flaw Could Enable Escape from Nested VMs

The flaw affects KVM/x86 Shadow MMU

The vulnerability CVE-2026-64561, dubbed Zapscape, affects the KVM/x86 Shadow MMU component of the Linux kernel. The issue involves the handling of shadow page tables used to translate memory in nested guests.

An attacker with kernel privileges inside an L1 virtual machine—normally equivalent to root in the guest—could exploit the flaw to escape KVM isolation and execute code on the Linux host with kernel-level or root privileges.

The vulnerability was publicly disclosed on August 6, 2026, by researcher Hyunwoo Kim, together with a proof of concept. There is no evidence of active exploitation.

A delayed check can lead to a use-after-free

The bug is caused by the order in which KVM checks whether the root is stale while handling a page fault generated by the guest.

Under certain conditions, KVM can reclaim MMU pages and invalidate the root that is still being used by the fault-handling path. The code does not recheck that state and may create child shadow pages under a root that is no longer valid.

The child pages inherit the parent’s invalid state and remain among the active MMU pages. Subsequent operations can therefore duplicate a link in two lists, free a page while leaving stale references behind, and trigger a write-after-free: a use-after-free condition classified by Red Hat as CWE-825 — expired pointer dereference.

The PoC demonstrates the primitive by creating a root-owned file named /Zapscape on the host. However, it is not immediately usable against cloud environments: it requires a kernel module in the L1 guest and adaptations to the host kernel configuration and memory backend.

Affected systems and fixed versions

The risk primarily affects hosts that expose nested virtualization to untrusted guests. The NVD lists Linux versions starting with 5.9 as affected, up to the following fixed releases:

• 6.6.148
• 6.12.101
• 6.18.42
• 7.1.6
• 7.2-rc5

The issue is present in KVM/x86, not QEMU. QEMU can be used for testing, but the vulnerability resides in KVM integrated into the kernel and can be triggered independently of QEMU emulation.

On Intel systems, both EPT page-walk lengths—4 and 5—must be exposed to the L1 guest. AMD systems have no equivalent requirement. The PoC targets AMD nested SVM/NPT on Linux 7.1.3; for controlled testing, Kim recommends QEMU TCG.

For Debian packages, as of August 6, 2026, kernels in bullseye, bookworm, and trixie, including their security repositories, as well as forky, were reported to be vulnerable. sid was fixed in version 7.1.6-1. Red Hat may distribute backported fixes without changing the upstream version string, so the version number alone is not sufficient.

Patch and mitigation measures

The upstream fix is commit 2abd5287f083. The change moves the stale-root check to after make_mmu_pages_available(). If reclaim invalidates the current root, KVM restarts fault handling with RET_PF_RETRY instead of continuing to use the invalid structure.

Administrators should:

1. update KVM hosts to a fixed release;
2. install the vendor package containing the backport;
3. check Linux, Red Hat, and Debian through their respective trackers;
4. restrict or disable nested virtualization for untrusted guests where possible.

Red Hat’s preliminary severity rating is CVSS 7.0. The potential impact is high in cloud and multi-tenant environments, where a compromised L1 guest could reach the host kernel.

The issue was reported to [email protected] on July 11, 2026; the patch was published and merged on July 21, 2026. The issue was submitted to the linux-distros list on August 1, 2026, assigned CVE-2026-64561 on August 4, 2026, and publicly disclosed on August 6, 2026.