A new vulnerability identified as CVE-2026-64561 has been discovered in the Linux kernel, specifically affecting the KVM/x86 shadow memory management unit (MMU). This flaw allows an attacker with kernel privileges within an L1 guest virtual machine (VM) to potentially escape KVM isolation and execute code on the host system. The issue arises when nested virtualization is exposed to untrusted guests.
Details of the Vulnerability
The vulnerability, referred to as Zapscape, is characterized as a stale-root check ordering flaw in KVM’s shadow-MMU bookkeeping. This can lead to a use-after-free condition during guest-triggered page fault handling. The KVM can reclaim MMU pages and invalidate the shadow MMU root page that is still in use, allowing KVM to continue operations under an invalidated root.
Exploit Path and Impact
Security researcher Hyunwoo Kim, who disclosed the vulnerability, demonstrated an exploit path that can execute commands on the host with kernel or root privileges. The required L1 kernel privilege typically means that the guest operates as root. For Intel systems, additional conditions must be met, including exposing both EPT page-walk lengths 4 and 5 to the L1 guest, while AMD systems do not have equivalent requirements.
Mitigation and Patch Information
The upstream fix for this vulnerability has been merged, and it is recommended that administrators running KVM hosts, particularly those exposing nested virtualization to untrusted guests, update to a fixed stable kernel or a vendor package that backports the patch. The National Vulnerability Database lists affected versions as Linux 5.9 and later, with specific stable releases including 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5.
Current Status and Recommendations
As of August 6, 2026, the vulnerability has not been reported as exploited in the wild. Kim noted that while a public proof-of-concept exists, it is not a weaponized exploit that can be executed immediately in cloud environments. Real-world exploitation would necessitate modifications to the L1 actions within a guest kernel module and adaptation to the host kernel configuration.
For safety, it is advisable to monitor updates from Linux vendors regarding the status of affected packages, as many may carry backported fixes without rebasing to a new upstream version. Red Hat has assigned a preliminary CVSS score of 7.0 to this vulnerability, classifying it as CWE-825, or expired pointer dereference.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
Original source: thehackernews.com
