Full Report
Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests. The flaw is tracked as CVE-2026-64561 and affects KVM/x86's shadow memory management unit (MMU), which manages shadow page
Analysis Summary
# Vulnerability: Zapscape KVM Shadow MMU Guest-to-Host Escape
## CVE Details
- **CVE ID:** CVE-2026-64561
- **CVSS Score:** 7.0 (High)
- **CWE:** CWE-825 (Expired Pointer Dereference / Use-After-Free)
## Affected Systems
- **Products:** Linux Kernel (KVM/x86 module)
- **Versions:** Affected from version 5.9 through 7.1.3. Fixed in stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5.
- **Configurations:**
- Systems running KVM with **nested virtualization** enabled and exposed to untrusted guests.
- **Intel systems:** Requires both EPT page-walk length 4 and 5 to be exposed to the L1 guest.
- **AMD systems:** Vulnerable without specific additional conditions.
## Vulnerability Description
Zapscape is a "stale-root check ordering flaw" within the KVM shadow memory management unit (MMU). The vulnerability occurs during guest-triggered page fault handling. When KVM calls `make_mmu_pages_available()` to reclaim memory, it may invalidate the shadow MMU root page currently in use.
Because the code does not re-verify the root's validity after the reclaim operation, it continues to create child shadow pages under the invalidated root. These child pages inherit an invalid state but remain on the active MMU page list. This results in a use-after-free (UAF) primitive where KVM may eventually attach the same list link to two different lists, leading to a dangling pointer and a post-free write.
## Exploitation
- **Status:** PoC available (demonstrated by researcher Hyunwoo Kim). Not currently reported as exploited in the wild.
- **Complexity:** High (Requires specific kernel configurations and memory backend adaptation).
- **Attack Vector:** Local (Requires kernel/root privileges within an L1 guest VM).
## Impact
- **Confidentiality:** High (Potential for full host memory access).
- **Integrity:** High (Ability to execute code with host kernel/root privileges).
- **Availability:** High (Potential for host system crashes or takeover).
## Remediation
### Patches
- **Upstream Linux Kernel:** Apply commit `2abd5287f083`.
- **Stable Releases:** Update to version 6.6.148, 6.12.101, 6.18.42, 7.1.6, or newer.
- **Distributions:** Update to Debian `sid` version 7.1.6-1 or check specific vendor trackers (Red Hat, Ubuntu, etc.) for backported security patches.
### Workarounds
- **Disable Nested Virtualization:** If not required, disabling nested virtualization prevents the attack surface from being exposed to guests.
- **Restrict Guest Privileges:** Since the exploit typically requires root/kernel privileges within the L1 guest, hardening guest OS access can reduce risk.
## Detection
- **Indicators of Compromise:** Presence of unauthorized files on the host filesystem (e.g., the PoC creates `/Zapscape`).
- **Detection Methods:** Monitor for unusual KVM MMU activity or kernel oops/warnings related to shadow page management. Use kernel auditing tools to track unexpected file creations by the KVM process.
## References
- **NVD:** [https://nvd.nist.gov/vuln/detail/CVE-2026-64561](https://nvd.nist.gov/vuln/detail/CVE-2026-64561)
- **Technical Write-up:** [https://github.com/V4bel/Zapscape/blob/main/assets/write-up.md](https://github.com/V4bel/Zapscape/blob/main/assets/write-up.md)
- **Vendor Advisory (Red Hat):** [https://access.redhat.com/security/cve/cve-2026-64561](https://access.redhat.com/security/cve/cve-2026-64561)
- **Linux Kernel Archive:** [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083)