Zapscape KVM flaw exposes nested Linux hosts to guest escape
A newly disclosed Linux kernel flaw in KVM could allow an attacker with kernel privileges in a nested L1 virtual machine to escape isolation and execute code on the host. The vulnerability, tracked as CVE-2026-64561 and dubbed Zapscape, affects the KVM/x86 shadow memory management unit used for nested guest memory translation.
Researcher Hyunwoo Kim demonstrated an exploit chain that creates a root-owned /Zapscape file on a vulnerable host. The upstream fix has already been merged, and administrators that expose nested virtualization to untrusted guests are advised to move to a fixed stable kernel or a vendor package carrying the backported patch.
Stale shadow-MMU root creates a use-after-free
Zapscape stems from the ordering of a stale-root check in KVM shadow-MMU bookkeeping. While handling a guest-triggered page fault, KVM can reclaim MMU pages and invalidate the shadow-MMU root still used by the fault path. The path could then continue beneath that invalidated root instead of checking it again.
Kim described the result as a use-after-free in the recursive zap path used to reclaim shadow pages. Child shadow pages created under the invalid root inherited its state but remained on KVM’s active MMU page list. During later cleanup, the same list link could be attached to two lists, leaving stale references after a page was freed and enabling a post-free write.
The merged fix, commit 2abd5287f083, moves the stale-root check to after make_mmu_pages_available(). If reclaim invalidates the active root, KVM now restarts fault handling with RET_PF_RETRY rather than mapping or fetching under an invalid root.
Exposure depends on nested virtualization configuration
The attack requires L1 kernel privilege, usually guest root, and applies where nested virtualization is made available to untrusted guests. On Intel hardware, both EPT page-walk length 4 and 5 must also be exposed to the L1 guest. AMD systems have no equivalent condition.
The public proof of concept targets AMD nested SVM/NPT on Linux 7.1.3. Kim recommends QEMU TCG for safe testing, while stressing that QEMU is not the vulnerable component: the flaw resides in in-kernel KVM and can be triggered independently of QEMU emulation. Kim said the proof of concept does not establish exploitation in the wild and is not a weaponized exploit that runs immediately in cloud environments.
The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases including 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2-rc5. Red Hat assigned a preliminary CVSS score of 7.0 and classified the issue as CWE-825, expired pointer dereference. This issue also fits the wider concern around borrowed trust in cybersecurity and shows why isolation boundaries must be assessed alongside the trust granted to guest workloads.
Patch status requires vendor checks
Package status cannot be inferred solely from an upstream version string, because vendors may backport fixes without rebasing. On August 6, Debian listed bullseye, bookworm, trixie and forky kernel packages as vulnerable, while sid was listed as fixed at 7.1.6-1.
Kim reported the issue to security@kernel.org on July 11, 2026; a patch was posted and merged on July 21. Public disclosure followed on August 6 after a five-day linux-distros embargo. Businesses operating KVM should inventory nested-virtualization exposure, restrict it for untrusted guests where possible, and validate fixed kernel packages with their Linux vendors.