Zapscape KVM flaw exposes nested Linux hosts to guest escape
A newly disclosed Linux kernel flaw in KVM could allow an attacker with kernel privileges in a nested L1 virtual machine to escape isolation and execute code on the host. The vulnerability, tracked as CVE-2026-64561 and dubbed Zapscape, affects the KVM/x86 shadow memory management unit used for nested guest memory translation.
Researcher Hyunwoo Kim demonstrated an exploit chain that creates a root-owned /Zapscape file on a vulnerable host. The upstream fix has already been merged, and administrators that expose nested virtualization to untrusted guests are advised to move to a fixed stable kernel or a vendor package carrying the backported patch.
Stale shadow-MMU root creates a use-after-free
Zapscape stems from the ordering of a stale-root check in KVM shadow-MMU bookkeeping. While handling a guest-triggered page fault, KVM can reclaim MMU pages and invalidate the shadow-MMU root still used by the fault path. The path could then continue beneath that invalidated root instead of checking it again.
Kim described the result as a use-after-free in the recursive zap path used to reclaim shadow pages. Child shadow pages created under the invalid root inherited its state but remained on KVM’s active MMU page list. During later cleanup, the same list link could be attached to two lists, leaving stale references after a page was freed and enabling a post-free write.
The merged fix, commit 2abd5287f083, moves the stale-root check to after make_mmu_pages_available(). If reclaim invalidates the active root, KVM now restarts fault handling with RET_PF_RETRY rather than mapping or fetching under an invalid root.
Exposure depends on nested virtualization configuration
The attack requires L1 kernel privilege, usually guest root, and applies where nested virtualization is made available to untrusted guests. On Intel hardware, both EPT page-walk length 4 and 5 must also be exposed to the L1 guest. AMD systems have no equivalent condition.
The public proof of concept targets AMD nested SVM/NPT on Linux 7.1.3. Kim recommends QEMU TCG for safe testing, while stressing that QEMU is not the vulnerable component: the flaw resides in in-kernel KVM and can be triggered independently of QEMU emulation. Kim said the proof of concept does not establish exploitation in the wild and is not a weaponized exploit that runs immediately in cloud environments.
The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases including 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2-rc5. Red Hat assigned a preliminary CVSS score of 7.0 and classified the issue as CWE-825, expired pointer dereference. This issue also fits the wider concern around borrowed trust in cybersecurity and shows why isolation boundaries must be assessed alongside the trust granted to guest workloads.
Patch status requires vendor checks
Package status cannot be inferred solely from an upstream version string, because vendors may backport fixes without rebasing. On August 6, Debian listed bullseye, bookworm, trixie and forky kernel packages as vulnerable, while sid was listed as fixed at 7.1.6-1.
Kim reported the issue to security@kernel.org on July 11, 2026; a patch was posted and merged on July 21. Public disclosure followed on August 6 after a five-day linux-distros embargo. Businesses operating KVM should inventory nested-virtualization exposure, restrict it for untrusted guests where possible, and validate fixed kernel packages with their Linux vendors.
Zapscape CVE-2026-64561: a practical exposure checklist
Zapscape is the name given to CVE-2026-64561, a Linux KVM vulnerability involving nested virtualization and shadow-MMU memory management. The key operational question is not simply whether a server runs KVM, but whether its configuration gives an untrusted, privileged L1 guest access to the affected nested-virtualization path.
When a KVM host may be exposed
Exposure depends on both the kernel package and the virtualization configuration. The demonstrated attack requires kernel-level privilege inside an L1 virtual machine, usually guest root, with nested virtualization available to that guest.
- Check which hosts expose nested virtualization to untrusted L1 guests.
- On Intel, verify whether EPT page-walk lengths 4 and 5 are both exposed.
- Do not apply the Intel-specific EPT condition to AMD systems.
- Treat the public proof of concept as evidence of feasibility, not exploitation in the wild.
How to verify the Zapscape fix
An upstream kernel version alone may not reveal patch status because Linux vendors can backport security fixes without changing to the latest upstream release. Confirmation should therefore come from the vendor package status or changelog for the kernel actually installed on each host.
- Inventory KVM hosts and record their installed kernel packages.
- Check each distribution vendor's advisory or package status.
- Move affected systems to a fixed stable kernel or a package carrying the backport.
- Restrict nested virtualization for untrusted guests where operationally possible.
What the patch changes
The flaw allowed fault handling to continue beneath a shadow-MMU root that had become invalid during page reclamation. The merged correction performs the stale-root check after reclamation and retries fault handling when the active root has been invalidated.
- The vulnerable component is in-kernel KVM, not QEMU itself.
- Testing with QEMU TCG avoids using the vulnerable KVM execution path.
Frequently asked questions
What is Zapscape?
Zapscape is the name of CVE-2026-64561, a Linux KVM flaw that can allow a privileged nested L1 guest to escape isolation and execute code on the host under the required conditions.
Does the Zapscape CVE affect every KVM server?
No. Relevant factors include the installed kernel package, whether nested virtualization is enabled, whether untrusted guests can access it and, on Intel, the exposed EPT page-walk lengths.
Can patch status be determined from the kernel version?
Not reliably. Distribution vendors may backport the fix, so administrators should verify the status of the exact installed package with the Linux vendor.
Is QEMU the vulnerable component?
No. The issue resides in the Linux kernel's KVM implementation. The article notes that QEMU TCG can be used for safer testing because it does not use the vulnerable KVM path.