A critical vulnerability in the Linux kernel, identified as CVE-2026-64561 and dubbed ‘Zapscape,’ has been discovered, enabling attackers to escape from a KVM virtual machine (VM) and gain root-level control over the host system. This flaw poses significant risks, particularly for cloud service providers and enterprises that run untrusted workloads.
KVM (Kernel-based Virtual Machine) is a virtualization module in the Linux kernel that allows the host machine to run multiple isolated VMs. The Zapscape vulnerability resides in KVM’s shadow memory management unit (MMU), which handles memory translations during nested virtualization scenarios. Nested virtualization allows a VM to run another VM within it, a feature often utilized in testing environments and cloud services but one that also increases the attack surface.
Security researcher Hyunwoo Kim, known as V4bel, identified that the vulnerability stems from a use-after-free bug in KVM’s recursive zap path. This flaw occurs when KVM frees a memory structure but continues to use it afterward, leading to potential memory corruption in the host kernel. An attacker operating within a guest VM can exploit this condition to break the isolation between the guest and host, effectively gaining root access to the host system.
The implications of such an exploit are severe. An attacker with root access to the host can execute arbitrary commands, access sensitive data, disrupt services, and potentially compromise other VMs running on the same host. In multi-tenant cloud environments, this could lead to cross-tenant attacks, jeopardizing the security of multiple customers.
A proof-of-concept exploit has been published on GitHub, demonstrating the escape from a guest VM to the host system in a controlled QEMU TCG environment. While this proof-of-concept is not a ready-made attack for cloud environments, it underscores the feasibility of adapting the exploit to real-world scenarios, highlighting the urgency for organizations to address this vulnerability.
The vulnerable code was introduced into the Linux kernel in 2020 and has been patched upstream as of July 21, 2026. The fix involves modifying the validation order in the shadow MMU fault path to ensure that KVM checks whether a root page has become invalid after making MMU pages available. If the page has been reclaimed, KVM will retry the fault instead of continuing to use the invalid structure.
Systems most at risk are those where nested virtualization is enabled and exposed to untrusted users, a common configuration in infrastructure-as-a-service deployments. On Intel-based systems, the vulnerability requires that both four-level and five-level Extended Page Tables (EPT) page-walk support be exposed to the Level 1 guest. AMD systems do not have this specific condition.
Administrators are strongly advised to apply the patched kernel versions provided by their vendors and reboot affected KVM hosts promptly. Until the patch is applied, it is recommended to disable nested virtualization for untrusted guests where feasible. Additional mitigation steps include restricting access to /dev/kvm, reviewing host configurations, identifying exposed multi-tenant systems, and monitoring vendor advisories for further updates.
The discovery of Zapscape underscores the critical importance of maintaining up-to-date hypervisor software and implementing robust security measures in virtualized environments. A single vulnerability that allows guest-to-host escapes can compromise the integrity of entire systems, emphasizing the need for vigilant patch management and security practices.
