New Zapscape KVM Flaw Allows L1 Guest Code to Escape to Linux Hosts

KVM Vulnerability Discovered

A new vulnerability, dubbed Zapscape and identified as CVE-2026-64561, has been found in the Linux kernel. This flaw specifically impacts KVM/x86's shadow memory management unit (MMU), which is responsible for managing shadow page tables used in nested guest memory translation.

Escape Mechanism

The Zapscape vulnerability allows an attacker with kernel privileges within an L1 guest virtual machine (VM) to bypass KVM isolation. This enables the attacker to execute arbitrary code on the host system with kernel or root privileges. The risk is present when nested virtualization is exposed to untrusted guests.

Technical Details

Security researcher Hyunwoo Kim described Zapscape as a stale-root check ordering flaw in KVM's shadow-MMU bookkeeping, leading to a use-after-free condition. During guest-triggered page fault handling, KVM can reclaim MMU pages and invalidate the shadow MMU root page while it is still in use by the fault-handling path. Because the path does not re-check the root, KVM continues under the invalidated root, creating child shadow pages that inherit an invalid state. This can lead to a dangling link and post-free write, which can be exploited.

Proof-of-Concept and Mitigation

Kim has provided a public proof-of-concept that demonstrates the flaw by creating a root-owned file named /Zapscape on the vulnerable KVM host. This proof-of-concept targets AMD nested SVM/NPT on Linux 7.1.3. An upstream fix for this vulnerability has been merged into the Linux kernel. Administrators operating KVM hosts that expose nested virtualization to untrusted guests should update to a fixed stable kernel version or a vendor package that includes the backported patch.