By Abinaya
Publication Date: 2026-08-07 13:32:00
A Linux kernel vulnerability, tracked as CVE-2026-64561 and named Zapscape, could allow attackers to escape a KVM virtual machine and take control of its underlying Linux host with root privileges.
The issue affects KVM/x86, a virtualization technology that separates guest systems from the physical server. The flaw is especially serious for cloud providers and enterprises that run untrusted workloads.
Zapscape was discovered by security researcher Hyunwoo Kim, known as V4bel. It exists in KVM’s shadow memory management unit, or shadow MMU. It manages memory translations when nested virtualization is used.
Nested virtualization allows one virtual machine to run another virtual machine inside it. While useful for testing and cloud services, it creates a larger attack surface.
The vulnerability is a use-after-free bug in the recursive zap path used by KVM when reclaiming shadow pages. In simple terms, KVM can free a memory structure but later continue to use it.
Zapscape KVM Escape Grants Root Access
A malicious guest can trigger that unsafe condition from inside the guest. This can corrupt memory in the host kernel, breaking the security boundary that normally keeps a guest separate from its host.
A successful attack could have severe consequences. An attacker with kernel-level control in an L1 guest may execute commands on the KVM host as root.
That could allow data theft, service disruption, access to other virtual machines on the same…