A new Linux kernel issue, tracked as Zapscape KVM flaw (CVE-2026-64561), highlights how quickly hypervisor boundaries can become risky when nested virtualization is exposed to untrusted workloads. If an attacker gains kernel-level privileges inside an L1 virtual machine, the flaw may allow them to bypass KVM isolation and execute code on the host.
Security researcher Hyunwoo Kim disclosed the bug and described an exploit path that can lead to commands running on the host with kernel or root privileges. While the public proof-of-concept focuses on specific configurations, the underlying fix is now available upstream and should be applied promptly by anyone using vulnerable KVM kernel builds.
What the Zapscape KVM flaw targets
The Zapscape KVM flaw affects KVM on x86 systems in the component responsible for shadow MMU management. In nested virtualization, KVM uses shadow page tables to translate memory for nested guests. The vulnerability lies in the logic that tracks and updates these shadow structures during guest-triggered fault handling.
The risk is most relevant when administrators expose nested virtualization to guests that should not be trusted. In practical terms, the attacker scenario requires privileges inside the L1 guest kernel, which typically corresponds to having root access within that L1 environment.
Why nested virtualization raises the stakes
Nested virtualization allows one VM to run another layer of virtualization inside it. That additional layer increases complexity in memory translation and hypervisor bookkeeping. According to the disclosure, the conditions for the bug also depend on CPU vendor features.
Intel systems require that specific EPT settings (page-walk lengths 4 and 5) are exposed to the L1 guest. AMD does not have an equivalent gating condition described in the advisory details.
How the bug works at a high level
The Zapscape KVM flaw is described as a stale-root check ordering issue in KVM’s shadow MMU accounting. During the handling of page faults triggered by the guest, KVM may reclaim MMU pages and invalidate the shadow MMU root that a fault-handling path is still using.
Because the fault path does not re-check the root after reclamation, KVM can proceed with an invalidated root. Kim’s write-up compares this to a use-after-free condition in the recursive zap path used when KVM reclaims shadow pages.
In the demonstrated flow, KVM checks whether the current root is stale before allocating more MMU pages. If reclamation invalidates that same root while KVM continues fault handling, child shadow pages can be created under the invalid state. Later cleanup can then end up with a page freed while stale references remain, enabling a post-free write primitive.
Proof-of-concept details and testing guidance
Kim published a public proof-of-concept that uses the bug’s primitive to build a chain capable of creating a root-owned file named /Zapscape on the host running a vulnerable KVM configuration.
The proof-of-concept targets AMD nested SVM/NPT on Linux 7.1.3. Importantly, the guidance emphasizes safe testing: Kim recommends running the proof-of-concept under QEMU TCG for isolation. QEMU itself is not the vulnerable component; the issue lives in in-kernel KVM and can be triggered independently of QEMU’s emulation behavior.
Has it been exploited in the wild?
As of Kim’s August 6 write-up, there is no claim that the vulnerability has been exploited in the wild. The disclosure also characterizes the bug as not an immediate, weaponized exploit for common cloud scenarios.
Real-world impact would likely require additional work, such as moving the L1 actions into a guest kernel module and adapting the exploit to the specific host kernel configuration and memory backend in use.
Affected versions and CVE information
The vulnerability is tracked as CVE-2026-64561 and relates to KVM/x86 shadow memory management unit handling. The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases.
Examples of fixed stable branches mentioned include:
- 6.6.148
- 6.12.101
- 6.18.42
- 7.1.6
- 7.2-rc5
Red Hat assigned a preliminary CVSS score of 7.0 and classified the issue as CWE-825 (expired pointer dereference). Package outcomes may vary depending on each distribution’s patch strategy, especially when backports are provided without rebasing to a new upstream version string.
Vendor packaging matters: update using your tracker
Administrators should not rely solely on upstream version numbers when deciding whether systems are fixed. Red Hat’s advisory notes that distribution packages can include backported fixes while keeping older upstream identifiers.
As of August 6, 2026, Debian’s security tracker reportedly listed several kernel package lines as vulnerable—specifically bullseye, bookworm, and trixie with their security repositories noted as impacted. It also listed forky as vulnerable and indicated sid as fixed at 7.1.6-1.
What changed in the upstream fix
The upstream fix has already been merged. The change moves the stale-root check to occur after make_mmu_pages_available(). In effect, if reclaim invalidates the current root, KVM now restarts the fault handling using RET_PF_RETRY rather than continuing with stale mapping behavior.
The merged upstream commit is referenced as 2abd5287f083. Once the logic is updated, KVM avoids continuing execution under an invalidated root state.
Suggested remediation steps for administrators
If your KVM hosts expose nested virtualization to guests you don’t fully trust, treat this as a priority update. A practical response plan usually looks like this:
- Update the kernel or vendor packages to a fixed stable release or a backport that includes the patch.
- Verify exposure: confirm whether nested virtualization is enabled and available to untrusted L1 guests.
- Apply distribution-specific guidance from your vendor’s security tracker, since backports may differ from upstream numbering.
- Test safely in a controlled environment if you need validation, following the recommendation to use QEMU TCG for testing.
Because exploitation depends on having privileged capabilities inside the L1 guest, the issue becomes especially relevant in multi-tenant or otherwise untrusted guest environments.
Disclosure timeline in brief
The reporting and coordination followed a structured timeline. Kim reportedly notified security@kernel.org on July 11, 2026. A patch was posted and merged on July 21, and the issue was submitted to the linux-distros list on August 1 under an embargo. CVE assignment followed on August 4, with public disclosure on August 6.
The disclosure also notes prior related KVM work by the same researcher, including issues tracked as Januscape (CVE-2026-53359) and ITScape (CVE-2026-46316), demonstrating ongoing attention to hypervisor boundary integrity.
Conclusion
The Zapscape KVM flaw (CVE-2026-64561) serves as a clear reminder that nested virtualization can expand the attack surface of hypervisors. When an attacker can obtain privileged access inside an L1 guest, a flaw in KVM’s shadow MMU bookkeeping may allow escape from isolation and code execution on the host.
To reduce risk, update KVM kernel builds or distribution packages to include the upstream fix and carefully review whether nested virtualization is exposed to untrusted guests.
Source: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html
