CVE-2026-64561: Zapscape KVM Escape Runs Commands With Kernel Root Privilege, PoC Exploit Code Publicly Disclosed
Do Son 
TL;DR
Security researcher Hyunwoo Kim (@v4bel) disclosed a KVM escape vulnerability named Zapscape. Tracked as CVE-2026-64561, it lets a guest break out to the host. The attacker can then run commands with kernel root privilege. The full details and proof-of-concept exploit code are now public.
- CVE: CVE-2026-64561
- CVSS: Awaiting analysis
- Product: Linux
- Affected: f95eec9bed76d42194c23153cb1cc8f186bf91cb, 5.9
- Impact: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
- Status: No confirmed exploitation yet
- Patched in: 35e77467610c4a37cb0ff54ee56b85f73b1f5700, 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf, f3477a6a4164f15287444eda685b5f6405dbd1e5, bce0d3c26e2c761a4bf43c8949f333fc7374eb2d (+6 more)
- EPSS: 0.2% (30-day)
- Action: Update to 35e77467610c4a37cb0ff54ee56b85f73b1f5700, 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf, f3477a6a4164f15287444eda685b5f6405dbd1e5, bce0d3c26e2c761a4bf43c8949f333fc7374eb2d (+6 more) now
Why it matters
KVM powers a large share of cloud and virtual servers. A guest-to-host escape breaks the core boundary of virtualization. So one rented VM could threaten an entire physical host.
The impact is severe. An attacker on a single cloud instance could crash the host and take down every other tenant. Alternatively, they could run root code on the host and seize all guests on it.
A second attack path
The flaw also enables local privilege escalation. On some distributions, /dev/kvm is world-writable. Therefore an unprivileged local user could abuse this KVM escape vulnerability to reach root.
How the attack works
Zapscape is a use-after-free in the KVM shadow MMU. The bug lives in the memory code that Intel and AMD share. It requires nested virtualization inside the guest.
In short, a stale-root check runs too early. Afterward, quota reclaim can invalidate the current root. However, the kernel keeps handling the fault on that now-invalid root.
As a result, an invalid child enters the active page list. The same list link then joins two lists at once and gets freed. That produces a dangling link and a post-free write.
Intel versus AMD
On AMD, there is no special constraint beyond nested virtualization. On Intel, the guest must have both EPT page walk length 4 and 5 exposed. This difference matters when you assess your exposure.
Public disclosure and exploit code
Researcher Hyunwoo Kim published full details and proof-of-concept code. The Zapscape research and PoC sit in a public repository. This release makes patching urgent.
Exploitation status
Public proof-of-concept exploit code exists for CVE-2026-64561. However, no in-the-wild exploitation has been confirmed at this time. The flaw does not affect QEMU emulation, since it lives in in-kernel KVM.
Affected versions
The bug spans Linux kernel commits from July 2020 to the July 2026 fix. The public demo used AMD nested virtualization on Linux 7.1.3.
Patch and mitigation
Upstream fixed the flaw by moving the stale-root check after quota reclaim. Now an invalidated root restarts the fault instead of mapping under it. Apply the latest kernel updates as soon as possible.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
