A newly disclosed Linux kernel vulnerability, dubbed Zapscape, could allow attackers with kernel-level access inside a nested virtual machine (VM) to break out of KVM isolation and execute code directly on the host system.
The vulnerability, tracked as CVE-2026-64561, affects the KVM/x86 shadow Memory Management Unit (MMU), a critical component responsible for managing shadow page tables used during nested virtualization. Systems that expose nested virtualization to untrusted guest VMs are considered at the highest risk.
What Is Zapscape?
Zapscape is a use-after-free vulnerability caused by an error in KVM’s shadow MMU management. During guest page-fault handling, KVM may reclaim memory pages and invalidate the shadow MMU root page currently in use. However, due to improper validation, KVM continues processing with the invalid root instead of restarting the operation.
This flaw can corrupt internal memory structures, eventually allowing an attacker to manipulate kernel memory and potentially execute arbitrary code on the host operating system.
Security researcher Hyunwoo Kim, who discovered and disclosed the issue, demonstrated that the exploit can execute commands on the host with root (kernel) privileges, effectively escaping the virtual machine.
Technical Details
According to Kim’s technical analysis, the vulnerability stems from a flaw in KVM’s recursive shadow page reclamation process.
Here’s how the attack works:
- KVM verifies whether the current shadow MMU root is still valid.
- It then frees MMU pages to reclaim memory.
- During reclamation, the same root page may become invalid.
- Instead of rechecking the root, KVM continues creating child shadow pages beneath the invalid parent.
- These corrupted pages remain in KVM’s active MMU page list.
- Later cleanup operations create dangling pointers, leading to a use-after-free condition and memory corruption.
This sequence ultimately provides attackers with a primitive capable of modifying kernel memory.
Kim’s proof-of-concept demonstrates the exploit by creating a root-owned file named /Zapscape on the vulnerable KVM host.
Who Is Affected?
The vulnerability primarily impacts Linux systems running KVM with nested virtualization enabled.
Requirements for successful exploitation include:
- Kernel (root) privileges inside the Level 1 (L1) guest VM.
- Nested virtualization exposed to untrusted guests.
- Intel systems require both EPT page-walk length 4 and 5 to be available.
- AMD systems do not have this additional hardware requirement.
Because guest root access is already necessary, the attack is not considered trivial. However, cloud providers or organizations offering nested virtualization to customers should treat the vulnerability seriously.
Proof-of-Concept Released
Kim has publicly released a proof-of-concept (PoC) exploit targeting AMD nested SVM/NPT on Linux 7.1.3.
The researcher recommends testing the PoC using QEMU’s Tiny Code Generator (TCG) for safety. Importantly, QEMU itself is not vulnerable. The flaw resides entirely within the Linux kernel’s KVM implementation and can be triggered independently of QEMU.
Kim also emphasized that the released PoC is not a weaponized exploit suitable for immediate attacks against cloud infrastructure. Real-world exploitation would require additional work, including:
- Developing a guest kernel module
- Adapting the exploit to the host kernel configuration
- Accounting for different memory backends
Currently, there are no reports of active exploitation in the wild.
Affected Linux Kernel Versions
The National Vulnerability Database (NVD) lists Linux kernel versions 5.9 and later as affected until patched.
Fixed kernel releases include:
- Linux 6.6.148
- Linux 6.12.101
- Linux 6.18.42
- Linux 7.1.6
- Linux 7.2-rc5
Keep in mind that Linux distributions often backport security fixes without changing the upstream version number.
Vendor Status
Red Hat
Red Hat assigned the vulnerability a preliminary CVSS score of 7.0 and classified it under CWE-825 (Expired Pointer Dereference).
The company also reminded administrators that patched packages may include security backports even if the reported kernel version appears vulnerable.
Debian
As of August 6, 2026, Debian reported the following:
- Bullseye – Vulnerable
- Bookworm – Vulnerable
- Trixie – Vulnerable
- Forky – Vulnerable
- Sid (Unstable) – Fixed in version 7.1.6-1
Administrators should verify their distribution’s security advisories rather than relying solely on kernel version numbers.
Patch Available
The Linux kernel maintainers have already merged the upstream fix.
The patch (commit 2abd5287f083) changes the order of operations during page reclamation. Instead of continuing with an invalid shadow MMU root, KVM now performs the stale-root validation after reclaiming pages.
If the root has been invalidated, KVM safely restarts the page fault using RET_PF_RETRY, preventing memory corruption and eliminating the use-after-free condition.
Administrators using KVM with nested virtualization should install an updated stable kernel or vendor-provided package containing the backported fix as soon as possible.
Disclosure Timeline
The coordinated disclosure followed this sequence:
- July 11, 2026 – Vulnerability reported to kernel security maintainers.
- July 21, 2026 – Patch submitted and merged.
- August 1, 2026 – Shared with Linux distributions under a five-day embargo.
- August 4, 2026 – CVE-2026-64561 assigned.
- August 6, 2026 – Public disclosure and proof-of-concept released.
Previous Research by Hyunwoo Kim
Zapscape is the latest in a series of virtualization security discoveries by Hyunwoo Kim. Earlier in 2026, the researcher disclosed:
- Januscape (CVE-2026-53359) – A separate KVM/x86 shadow MMU vulnerability.
- ITScape (CVE-2026-46316) – A KVM/arm64 virtual machine escape flaw.
These findings highlight the ongoing importance of securing virtualization technologies as they continue to power cloud infrastructure, enterprise data centers, and virtualization platforms worldwide.
Final Thoughts
Although Zapscape requires elevated privileges inside a guest VM and specific virtualization configurations, it demonstrates how subtle flaws in kernel memory management can undermine virtualization security.
Organizations using KVM with nested virtualization, especially in multi-tenant or cloud environments, should prioritize applying vendor patches and reviewing their virtualization configurations to minimize exposure.
