# CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host

> A use-after-free vulnerability in KVM/x86's shadow MMU (CVE-2026-64561, CVSS 7.0) allows a privileged L1 guest to escape KVM isolation and execute arbitrary code on the host. A public proof-of-concept (PoC) by Hyunwoo Kim demonstrates full guest-to-host escape creating a root-owned file on the host. The flaw affects Linux kernels 5.9+ and has been fixed in upstream stable releases. No evidence of in-the-wild exploitation as of disclosure.

- **Published:** 2026-08-06T00:00:00Z
- **Last reviewed:** 2026-08-09T08:25:52.821Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1919
- **ID:** TL-2026-1919
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-64561

## Description

CVE-2026-64561 (dubbed "Zapscape") is a use-after-free vulnerability in the Linux kernel KVM/x86 shadow Memory Management Unit (MMU), specifically in the recursive zap path executed during shadow page reclamation. The flaw is an ordering bug in the page fault handling path within arch/x86/kvm/mmu/mmu.c and arch/x86/kvm/mmu/paging_tmpl.h. During guest-triggered page fault handling, KVM checks whether the current shadow MMU root is stale or invalid before calling make_mmu_pages_available(). However, the memory reclamation triggered by that call can zap (invalidate) the same root that the ongoing fault path is using. Because the stale-root check was performed before reclamation, KVM does not re-validate the root afterward. It proceeds to map or fetch shadow pages under the now-invalidated root. Child shadow pages inherit their parent's role.invalid flag, causing them to be placed on the active MMU page list while carrying an invalid state — violating KVM's invariant (introduced in Linux 5.9) that invalid shadow pages must never appear on the list of active MMU pages. This creates a corrupted MMU state with dangling list links, enabling a use-after-free that can be leveraged for arbitrary code execution on the host kernel.

The underlying flaw traces back to a 2008 commit (2e53d63acba7) that introduced the "ignore zapped root pagetables" behavior, but the invariant violation that makes the bug exploitable was introduced in Linux 5.9 (2020). The regression commit f95eec9bed76 (2020-07-08) created the exploitable window.

Exploitation requires kernel-level access inside an L1 guest VM (nested virtualization must be exposed to untrusted guests). On Intel platforms, both EPT page-walk length 4 and 5 must be exposed to the L1 guest. The PoC targets AMD SVM/NPT on Linux 7.1.3 (tested under QEMU TCG). It uses a "switching long→PAE" technique to alias one shadow page as both child and pinned root, then triggers L2 memory accesses that cause L0's quota reclamation to fire the recursive zap without a root_count guard. The outcome is a root-owned file (/Zapscape) created on the host, proving full escape. Hyunwoo Kim described the PoC as "not a weaponized exploit that runs immediately" in cloud environments — real-world adaptation would require converting L1 actions into a guest kernel module and tailoring the exploit to the host kernel config and memory backend.

The vulnerability was responsibly disclosed to security@kernel.org on July 11, 2026. The fix (commit 2abd5287f083, merged in Linux 7.2-rc5) relocates the stale-root check to after make_mmu_pages_available(). If reclamation invalidates the current root, KVM now restarts the fault with RET_PF_RETRY instead of continuing under an invalid root. A secondary note in the commit acknowledges that inheriting role.invalid in child shadow pages is suboptimal and will be addressed separately.

Affected Linux kernel versions span 5.9 through 7.1.x. Fixed releases: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Distribution status: Debian trixie (fixed 6.12.101-1) and sid (fixed 7.1.6-1); Debian bullseye, bookworm, and forky remain vulnerable. Red Hat has issued analysis (CVSS 7.0). Ubuntu, Oracle, and SUSE advisories are pending. No cloud provider (AWS, Azure, GCP) has published a specific advisory, as most do not expose nested virtualization to untrusted tenants by default. CISA KEV does not currently list this CVE. The researcher, Hyunwoo Kim (@v4bel), has prior KVM escape CVEs: Januscape (CVE-2026-53359, a separate KVM/x86 shadow-MMU bug) and ITScape (CVE-2026-46316, a KVM/arm64 escape).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1611 Escape to Host
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1082 System Information Discovery
- T1057 Process Discovery
- T1588 Obtain Capabilities
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1059.004 Command and Scripting Interpreter
- T1499.004 Endpoint Denial of Service
- T1588.005 Obtain Capabilities
- T1588.006 Obtain Capabilities
- T1574 Hijack Execution Flow
- T1587.004 Develop Capabilities

## Sources

- [The Hacker News — New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts](https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html)
- [NVD Detail — CVE-2026-64561](https://nvd.nist.gov/vuln/detail/CVE-2026-64561)
- [Red Hat Security — CVE-2026-64561](https://access.redhat.com/security/cve/cve-2026-64561)
- [Debian Security Tracker — CVE-2026-64561 (DSA-6415-1)](https://security-tracker.debian.org/tracker/CVE-2026-64561)
- [Tenable — CVE-2026-64561](https://www.tenable.com/cve/CVE-2026-64561)
- [GitHub — V4bel/Zapscape (PoC Repository)](https://github.com/V4bel/Zapscape)
- [kernel.org — Fix commit 2abd5287f083](https://git.kernel.org/linus/2abd5287f08319fa35764566b15c6e22cb1068db)
- [HEAL Security — Zapscape Analysis Summary](https://healsecurity.com/new-zapscape-kvm-flaw-could-let-privileged-l1-guest-code-escape-to-linux-hosts/)
- [Ubuntu Security — CVE-2026-64561](https://ubuntu.com/security/CVE-2026-64561)
- [CVE.org — CVERecord CVE-2026-64561](https://www.cve.org/CVERecord?id=CVE-2026-64561)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1919