CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host

CVE-2026-64561 (TL-2026-1919), also tracked as Zapscape, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-08-06 and last reviewed 2026-08-09. It has no confirmed attribution, affects Linux Linux Kernel (KVM/x86), references 1 CVE (CVE-2026-64561), maps to 17 MITRE ATT&CK techniques (T1036, T1057, T1059), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-1919

Threat ID
TL-2026-1919
Also known as
Zapscape
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-06
Last reviewed
2026-08-09
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
cloud-service-providers, hosting, enterprise-virtualization, telecoms, government administration
Target regions
Global
Detection rules
9
Indicators of compromise
25
Updates
2026-08-09 · revalidated 1× · latest source

Malware and tooling in CVE-2026-64561

Malware and tooling: Zapscape, embargo, KVM nested virtualization layer

A use-after-free vulnerability in KVM/x86's shadow MMU (CVE-2026-64561, CVSS 7.0) allows a privileged L1 guest to escape KVM isolation and execute arbitrary code on the host. A public proof-of-concept (PoC) by Hyunwoo Kim demonstrates full guest-to-host escape creating a root-owned file on the host. The flaw affects Linux kernels 5.9+ and has been fixed in upstream stable releases. No evidence of in-the-wild exploitation as of disclosure.

How CVE-2026-64561 works

CVE-2026-64561 (dubbed "Zapscape") is a use-after-free vulnerability in the Linux kernel KVM/x86 shadow Memory Management Unit (MMU), specifically in the recursive zap path executed during shadow page reclamation. The flaw is an ordering bug in the page fault handling path within arch/x86/kvm/mmu/mmu.c and arch/x86/kvm/mmu/paging_tmpl.h. During guest-triggered page fault handling, KVM checks whether the current shadow MMU root is stale or invalid before calling make_mmu_pages_available(). However, the memory reclamation triggered by that call can zap (invalidate) the same root that the ongoing fault path is using. Because the stale-root check was performed before reclamation, KVM does not re-validate the root afterward. It proceeds to map or fetch shadow pages under the now-invalidated root. Child shadow pages inherit their parent's role.invalid flag, causing them to be placed on the active MMU page list while carrying an invalid state — violating KVM's invariant (introduced in Linux 5.9) that invalid shadow pages must never appear on the list of active MMU pages. This creates a corrupted MMU state with dangling list links, enabling a use-after-free that can be leveraged for arbitrary code execution on the host kernel.

The underlying flaw traces back to a 2008 commit (2e53d63acba7) that introduced the "ignore zapped root pagetables" behavior, but the invariant violation that makes the bug exploitable was introduced in Linux 5.9 (2020). The regression commit f95eec9bed76 (2020-07-08) created the exploitable window.

Exploitation requires kernel-level access inside an L1 guest VM (nested virtualization must be exposed to untrusted guests). On Intel platforms, both EPT page-walk length 4 and 5 must be exposed to the L1 guest. The PoC targets AMD SVM/NPT on Linux 7.1.3 (tested under QEMU TCG). It uses a "switching long→PAE" technique to alias one shadow page as both child and pinned root, then triggers L2 memory accesses that cause L0's quota reclamation to fire the recursive zap without a root_count guard. The outcome is a root-owned file (/Zapscape) created on the host, proving full escape. Hyunwoo Kim described the PoC as "not a weaponized exploit that runs immediately" in cloud environments — real-world adaptation would require converting L1 actions into a guest kernel module and tailoring the exploit to the host kernel config and memory backend.

The vulnerability was responsibly disclosed to security@kernel.org on July 11, 2026. The fix (commit 2abd5287f083, merged in Linux 7.2-rc5) relocates the stale-root check to after make_mmu_pages_available(). If reclamation invalidates the current root, KVM now restarts the fault with RET_PF_RETRY instead of continuing under an invalid root. A secondary note in the commit acknowledges that inheriting role.invalid in child shadow pages is suboptimal and will be addressed separately.

Affected Linux kernel versions span 5.9 through 7.1.x. Fixed releases: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Distribution status: Debian trixie (fixed 6.12.101-1) and sid (fixed 7.1.6-1); Debian bullseye, bookworm, and forky remain vulnerable. Red Hat has issued analysis (CVSS 7.0). Ubuntu, Oracle, and SUSE advisories are pending. No cloud provider (AWS, Azure, GCP) has published a specific advisory, as most do not expose nested virtualization to untrusted tenants by default. CISA KEV does not currently list this CVE. The researcher, Hyunwoo Kim (@v4bel), has prior KVM escape CVEs: Januscape (CVE-2026-53359, a separate KVM/x86 shadow-MMU bug) and ITScape (CVE-2026-46316, a KVM/arm64 escape).

MITRE ATT&CK techniques used in TL-2026-1919

Defense Evasion

T1036 Masquerading; T1211 Exploitation for Defense Evasion

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1574 Hijack Execution Flow; T1611 Escape to Host

Initial Access

T1078 Valid Accounts

Impact

T1499.004 Endpoint Denial of Service

Resource Development

T1587.004 Develop Capabilities; T1588 Obtain Capabilities; T1588.005 Obtain Capabilities; T1588.006 Obtain Capabilities

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-64561

  • Linux — Linux Kernel (KVM/x86)
    Vulnerable versions: 5.9 through 7.1.x; 6.6.x (< 6.6.148); 6.12.x (< 6.12.101); 6.18.x (< 6.18.42); 7.1.x (< 7.1.6); 7.x mainline (< 7.2-rc5)
    Fixed in: 6.6.148; 6.12.101; 6.18.42; 7.1.6; 7.2-rc5
  • Debian — linux (kernel)
    Vulnerable versions: bullseye (5.10.223-1 / 5.10.262-1); bookworm (6.1.176-1 / 6.1.180-1); trixie (6.12.94-1); forky (7.1.3-1)
    Fixed in: trixie (6.12.101-1); sid/unstable (7.1.6-1)
  • Red Hat — Enterprise Linux (kernel)
    Vulnerable versions: RHEL kernels based on 5.9+ — subject to backport analysis per trackers
    Fixed in: Pending vendor-specific kernel update
  • Ubuntu — Linux kernel
    Vulnerable versions: Kernels 5.9+ — currently under assessment
    Fixed in: Pending Ubuntu-specific kernel update
  • Oracle — Unbreakable Enterprise Kernel (UEK)
    Vulnerable versions: Kernels 5.9+ — no specific advisory published yet
    Fixed in: Pending Oracle advisory
  • SUSE — Linux Enterprise Server (kernel)
    Vulnerable versions: Kernels 5.9+ — related KVM CVEs (CVE-2026-46113, CVE-2026-53359) fixed in SUSE 2026-22984-1, but CVE-2026-64561 not explicitly listed
    Fixed in: Pending SUSE-specific kernel update

Remediation for CVE-2026-64561

Patches

  • Linux 6.6: update to 6.6.148 or later
  • Linux 6.12: update to 6.12.101 or later
  • Linux 6.18: update to 6.18.42 or later
  • Linux 7.1: update to 7.1.6 or later
  • Linux mainline: update to 7.2-rc5 or later
  • Debian trixie: linux 6.12.101-1
  • Debian sid: linux 7.1.6-1
  • Debian DSA-6415-1 covers the fix for testing/unstable

Immediate actions

  • Apply the upstream kernel fix by updating to one of the fixed versions: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5
  • Disable nested virtualization (KVM nesting) on hosts where it is not strictly required — this removes the primary attack surface
  • Audit which cloud instances and host systems expose nested virtualization to untrusted tenants

Workarounds

  • KVM nested=0 module parameter on kvm_amd/kvm_intel
  • sched_rt_runtime_us hardening for DoS mitigation
  • Restrict /dev/kvm permissions (avoid 0666 world-writable) — reduces LPE risk on single-host scenarios

Longer-term hardening

  • Establish a kernel patching SLA shorter than the standard disclosure-to-patch window (currently ~26 days)
  • Deploy runtime kernel security monitoring (e.g., Falco, Tracee) to detect anomalous KVM shadow MMU activity
  • Implement virtual-patching / IDS rules for known KVM escape behavioral signatures
  • Segment KVM host infrastructure with additional isolation layers (e.g., Kata Containers, gVisor) for untrusted workloads

CVEs associated with CVE-2026-64561

CVE-2026-64561

Weaknesses (CWE) in CVE-2026-64561

CWE-825

Timeline of CVE-2026-64561

  • Original code allowing zapped root page table behavior was introduced in KVM shadow MMU (commit 2e53d63acba7, 'KVM: MMU: ignore zapped root pagetables')
  • Linux 5.9 kernel added the invariant that invalid shadow pages must never be on the active MMU page list, which made the 2008 flaw exploitable as a use-after-free
  • Commit f95eec9bed76 created the precise exploitable window by altering shadow MMU reclamation behavior
  • Hyunwoo Kim (@v4bel) reported the vulnerability to the Linux kernel security team (security@kernel.org)
  • KVM upstream maintainers discuss the fix strategy for the stale-root check ordering flaw.
  • Fix commit 2abd5287f083 was posted to the KVM mailing list and merged into the mainline kernel (tagged for 7.2-rc5), moving the stale-root check to after make_mmu_pages_available()
  • Red Hat ships patched kernel-5.14.0-687.30.1.el9_8 for RHEL 9.
  • Red Hat ships patched kernel-4.18.0-553.147.1.el8_10 for RHEL 8.
  • Vulnerability submitted to the linux-distros mailing list for a 5-day coordinated embargo before public disclosure
  • CVE-2026-64561 ID assigned by kernel.org. Debian issued DSA-6415-1. NVD published the CVE record.
  • Public disclosure: The Hacker News published the Zapscape article. Hyunwoo Kim released the PoC repository (github.com/V4bel/Zapscape) demonstrating full L1 guest-to-host escape on Linux 7.1.3 with AMD SVM/NPT under QEMU TCG
  • TuxCare/CloudLinux testing reports the public PoC does not reproduce a full guest-to-host escape on CloudLinux kernels, observing only L1 guest crashes instead — the escape path remains credible but is configuration- and build-dependent.
  • Cyber Security News, The Hacker News, TuxCare, CloudLinux, and SecurityOnline publish coverage and mitigation guidance for the Zapscape KVM escape.

Update history for TL-2026-1919

Sources cited for CVE-2026-64561

Threats related to CVE-2026-64561

Detection coverage for TL-2026-1919

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1919 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats