A newly disclosed vulnerability in the Linux kernel could allow attackers with elevated privileges inside a guest virtual machine to break out of their isolated environment and execute code on the host system, according to a security disclosure published by researcher Hyunwoo Kim on August 6, 2026. The flaw, dubbed Zapscape and tracked as CVE-2026-64561, affects KVM/x86's shadow memory management unit, which handles shadow page tables used for nested guest memory translation. The risk is present when nested virtualization is made available to untrusted guests.
The vulnerability stems from a stale-root check ordering flaw in KVM's shadow-MMU bookkeeping that can trigger a use-after-free condition, Kim explained in a technical write-up. During guest-triggered page fault handling, KVM can reclaim MMU pages and invalidate the shadow MMU root page still being used by the fault-handling path. Because the path doesn't check the root again, KVM can continue operating under the invalidated root. KVM checked whether the current root was stale before making more MMU pages available, but reclaim could then invalidate that same root while KVM continued the fault path and created child shadow pages beneath it. Those child pages inherited the invalid state from the parent and were still placed on KVM's active MMU page list, leading to cleanup that could attach the same list link to two lists simultaneously, then free the page while stale list references remain. The National Vulnerability Database lists Linux 5.9 and later as affected until fixed stable releases, including 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Red Hat assigned a preliminary CVSS score of 7.0 and classified the issue as CWE-825, or expired pointer dereference.
Kim's public proof-of-concept uses the vulnerability to build a full exploit chain that creates a root-owned file named /Zapscape on the host running the vulnerable KVM. The proof-of-concept targets AMD nested SVM/NPT on Linux 7.1.3, and the demonstrated exploit path can run commands on the host with kernel, or root, privileges. However, Kim described the bug as "not a weaponized exploit that runs immediately" in cloud environments, saying real-world use would require moving the L1 actions into a guest kernel module and adapting the exploit to the host kernel configuration and memory backend. The required L1 kernel privilege usually means guest root, and Intel systems also require both EPT page-walk length 4 and 5 to be exposed to the L1 guest, while AMD has no equivalent condition. Kim's August 6 write-up includes the public proof-of-concept but doesn't claim the flaw has been exploited in the wild.
The core issue arises because KVM's shadow MMU implementation didn't properly synchronize its bookkeeping when reclaiming memory pages during nested virtualization operations, the disclosure explains. When a guest VM triggers a page fault, the hypervisor must translate guest physical addresses to host physical addresses using shadow page tables. If KVM needs to reclaim memory during this process, it can invalidate the root page table entry that the fault handler is still actively using. The handler then continues building new page table entries under an invalidated parent, creating orphaned data structures that remain linked into KVM's internal lists even after being freed. This sets up a classic use-after-free scenario where subsequent operations can corrupt kernel memory, ultimately giving an attacker inside the guest the ability to execute arbitrary code on the host with full kernel privileges. The upstream fix, merged as commit 2abd5287f083, moves the stale-root check after make_mmu_pages_available() so that if reclaim invalidates the current root, KVM now restarts the fault with RET_PF_RETRY instead of continuing to map or fetch under the invalid root. Administrators running KVM hosts that expose nested virtualization to untrusted guests should update to a fixed stable kernel or a vendor package that backports the patch. Kim reported the issue to security@kernel.org on July 11, 2026, a patch was posted and merged on July 21, the issue was submitted to the linux-distros list on August 1 under a five-day embargo, and CVE-2026-64561 was assigned on August 4 before public disclosure on August 6. The disclosure follows Kim's earlier KVM work, including Januscape (CVE-2026-53359), a separate KVM/x86 shadow-MMU issue covered in July, and ITScape (CVE-2026-46316), a KVM/arm64 escape published in June. Cloud providers and virtualization platforms that rely on nested virtualization face renewed pressure to validate their patch deployment processes, particularly as security researchers continue uncovering subtle memory management flaws in hypervisor isolation boundaries that were long assumed to be robust.