Zapscape: KVM Vulnerability Lets Attackers Escape a Guest VM onto the Linux Host

Researcher Hyunwoo Kim has disclosed a Linux kernel vulnerability dubbed Zapscape (CVE-2026-64561). It affects the shadow memory management unit (shadow MMU) in KVM/x86, which is responsible for shadow page tables when translating the memory of nested guests. An attacker with kernel privileges inside an L1-level guest machine (typically root in the guest) can break out of KVM's isolation and execute code on the host as root.

What the bug is

Zapscape is a bug in the order in which a “stale” root is checked in the shadow MMU's bookkeeping structures, leading to a use-after-free. While handling a guest-initiated page fault, KVM may free MMU pages and invalidate the shadow MMU's root page while it is still in use by the fault handler. Because the code does not re-check the root, work continues under an invalid root. Child pages inherit the incorrect state but remain in the active list, and the subsequent cleanup can lead to double linking, freeing of a page, and a write through a dangling pointer.

Kim's public proof-of-concept uses this primitive to create a root-owned file /Zapscape on the host. The demonstration targets nested AMD SVM/NPT on Linux 7.1.3; for safe testing the author recommends running under QEMU TCG, stressing that QEMU itself is not vulnerable — the problem lives in the KVM built into the kernel.

Preconditions and scope

On Intel systems, the attack requires that the L1 guest have EPT walk lengths 4 and 5 available; AMD has no such condition. According to the NVD, Linux versions from 5.9 onward are affected. Red Hat assigned a preliminary CVSS score of 7.0 and classified the issue as CWE-825 (expired pointer dereference).

Kim clarifies that this is “not a ready-to-use weapon”: for real-world exploitation in the cloud, the L1-level actions would have to be moved into a guest kernel module and adapted to the host's configuration. No cases of exploitation in real attacks have been reported.

The fix

The patch has already been accepted upstream (commit 2abd5287f083): the stale-root check was moved after make_mmu_pages_available(), and when the root is invalidated KVM restarts fault handling instead of continuing under an invalid root. The fixes made it into stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Administrators of KVM hosts that expose nested virtualization to untrusted guests are advised to update. That said, package status depends on the individual distribution's tracker: as of August 6, Debian flagged the kernels in bullseye, bookworm, trixie, and forky as vulnerable, whereas sid was already fixed.

Zapscape continues Kim's series of work on KVM — he previously disclosed Januscape (CVE-2026-53359) and ITScape (CVE-2026-46316).

Source: The Hacker News