The Short Version

CVE-2026-64561, named Zapscape, is a use-after-free in KVM's shadow MMU on x86. A guest that can run nested virtual machines can trigger it and execute code with root privileges on the host kernel. The researcher Hyunwoo Kim (v4bel) published a working proof of concept on GitHub on August 6, 2026 after the coordinated embargo ended. The fix landed upstream in commit 2abd5287f083 on July 21.

The Zapscape KVM escape sits in the same shadow page table code that produced the Januscape (CVE-2026-53359) and ITScape (CVE-2026-46316) escapes earlier in 2026, making it the third entry in the researcher's "KVM Escape Trilogy." This one has a different root cause than its predecessors, and on AMD it fires with no special configuration at all.

Vulnerability Details

Zapscape is a use-after-free (UAF) in the recursive zap path of the x86 shadow MMU. When an L1 guest runs an L2 guest, KVM cannot use a single hardware page table for both nested page table levels, so it shadows the nested EPT or NPT structures with software-managed pages tracked in struct kvm_mmu_page.

The bug appears when KVM reclaims shadow pages because the per-VM quota is exhausted. The top level reclaim walk correctly skips pages currently used as active roots by checking root_count. The recursive path that zaps a child while removing its parent SPTE does not. It only checks whether the last parent has disappeared.

The sequence that breaks the guest-host boundary is:

1. An L1 guest aliases one shadow page as both a child of one nested page table and the root of another, using the same GFN and matching role.
2. mmu_alloc_root() finds the existing page and increments its root_count.
3. Quota reclaim selects the parent of that page, and the recursive zap path prepares the aliased page even though it is still a pinned root.
4. KVM marks it invalid and detaches it, but keeps serving page faults under it because the stale root check ran before the reclaim.
5. New children created under the invalid root inherit the invalid role, and the same list link later lands on two lists at once, then gets freed. That produces a dangling link and a post-free write.

The upstream patch fixes the ordering. In direct_page_fault and the template-based FNAME(page_fault) handler, KVM now runs the stale root check after make_mmu_pages_available() instead of before it. When quota reclaim invalidates the current root, the fault restarts with RET_PF_RETRY instead of mapping and fetching under a dead root.

Exploit Mechanics

The public PoC targets AMD nested SVM with NPT and runs on Linux 7.1.3 in QEMU TCG so it is safe to test. A tiny nested virtualization stack is built from guest userspace through /dev/kvm: a 518 MiB guest_memfd, two vCPUs, x2APIC, and L2 code that touches memory in a carefully chosen order.

The L2 workload fills the shadow page quota (2,652 pages for the 518 MiB memslot) to position the header cache, then triggers the vulnerable fault that runs quota reclaim and invalidates a still-pinned root. On success the escape writes a file named /Zapscape owned by uid 0 on the host.

The binary is not a weaponized cloud exploit, but the writeup states plainly that moving the L1 actions into a guest kernel module and adjusting kconfig for the host kernel is not difficult.

Intel has an extra constraint, which matters when assessing scope: the L1 guest must have Intel EPT page walk lengths 4 and 5 both exposed so it can build a PWL5 child that is reused as a PWL4 EPT root. AMD has no such condition.

Impact Assessment

The impact is identical to Januscape:

• Full KVM escape: root code execution on the host kernel from inside the guest.
• Host denial of service: in a shared cloud, panicking the host kernel takes down every tenant VM running on the same physical machine.
• Multi-tenant takeover: a single rented instance can become host root and compromise all guests on that box.
• Local privilege escalation: on distributions where /dev/kvm is world writable (mode 0666, common on RHEL-family setups), an unprivileged local user can use the same bug as an LPE to gain root. VMM ioctls are available in the LPE scenario, which makes the exploit easier and more stable.

Guest root inside L1 is required for the documented route, and that condition is satisfied by default in most IaaS workloads. Where guest root is not available, the researcher notes it can be chained with a guest-side LPE such as Dirty Frag.

Affected Systems

Zapscape affects KVM/x86 hosts that run nested virtualization and accept untrusted guests. The vulnerable range spans a six year window, from July 8, 2020 (commit f95eec9bed76) to July 21, 2026 (commit 2abd5287f083). Most exposed: multi-tenant public cloud providers, VPS hosts, desktop Linux users running nested VMs with KVM, and security-critical CI environments that execute untrusted code in nested guests emulated by KVM.

The bug lives in in-kernel KVM, not in QEMU's emulation. It can therefore also affect clouds with custom virtualization stacks when KVM is the hypervisor core.

Mitigation and Patching

1. Track down the kernel version on every host that exposes KVM: uname -r.
2. Update to a vendor kernel containing upstream commit 2abd5287f083 or newer. This includes Debian 13 "Trixie" kernel security update, which addressed Zapscape and SCTPhantom together on August 4.
3. Reboot the hosts after installing the patched kernel.
4. If patching is delayed, disable nested virtualization for untrusted guests where this is operationally possible (for example, clear the vmx/svm flags related to nesting at the hypervisor level).
5. Restrict /dev/kvm access and grant it only to trusted users and services, ideally through an ACL or a dedicated group. This neutralizes the local LPE version of the bug.
6. In cloud environments, review the firmware and kernel update schedule with your provider and look for maintenance windows that mention KVM reboot.

A detection angle is limited because this is a memory corruption in the kernel MM; there is no network signature. Behavioral rules around unexpected kernel panics of hosts running nested workloads, or abnormal guest_memfd usage inside guest VMs, are the only practical signals. With the PoC public and known TTPs documented, the risk level qualifies for daily monitoring until patched.

Frequently Asked Questions

Is the fix available in stable releases?

Yes, the fix is confirmed in mainline as of late July and vendors are shipping it. Verify with uname -a, then check your distro advisory for the commit.

Does this hit QEMU in any way?

No. The bug is fully inside KVM, and it appears in-kernel. QEMU only touches guest userspace.

Is AMD or Intel expected to offer more protection?

Neither. The public PoC targets AMD because that path has no PWL4/PWL5 constraint, but the underlying UAF is shared across both vendors.

Do I need root inside the guest?

For the documented escape, yes. Cloud instances usually grant root on your own VM, so that requirement is normally satisfied.

What if I cannot patch immediately?

Apply the equivalent of a shutdown: disable nested virtualization for untrusted workloads, lock down /dev/kvm, and keep unpatchable hosts away from untrusted guest code.

Why are KVM escape flaws appearing so frequently?

The KVM shadow MMU code that handles nested page table aliasing is subtle, and V4bel is publishing high-quality research from the outside. The practical answer is that hypervisors need the same regular patch choreography as kernels and browsers.

Key Takeaways

• CVE-2026-64561 Zapscape lets a malicious guest run code as root on the host via a use-after-free in KVM shadow MMU.
• Affected range spans six years: from 2020-07-08 (f95eec9bed76) to 2026-07-21, patched only since July 21, 2026.
• The PoC is public, so assume adversaries can turn it into a real cloud payload.
• Patch the kernel on every KVM host now, reboot, and restrict /dev/kvm.
• Disable nested virtualization for untrusted guests where you cannot patch right away.
• This is the third KVM escape from the same researcher this year; hypervisor hardening should be a standing item, not an incident reaction.

---

Sources: GitHub PoC and writeup, oss-security disclosure, Cyber Security News, Debian kernel update (9to5Linux)