A researcher has published the details of a Linux flaw that lets code running inside a virtual machine break out and take over the host underneath it. Hyunwoo Kim, who posts as @v4bel, disclosed the bug, which he calls Zapscape, to the oss-security mailing list on 6 August, after an embargo agreed with Linux distribution maintainers expired. The fix is already in mainline.
Kim describes Zapscape (CVE-2026-64561) as "a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive zap path that runs when shadow pages are reclaimed". KVM is the virtualization layer built into the Linux kernel itself, the component that cloud providers and a great many self-hosted virtualization stacks rely on to keep one tenant's virtual machine walled off from another's. The shadow MMU is the piece of it that emulates memory address translation for guests. A use-after-free means the kernel carries on using memory it has already released, which an attacker can arrange to have refilled with data of their own choosing.
What's affected
By Kim's account the bug threatens "the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds". Two preconditions narrow that considerably, and both matter.
The first is nested virtualization, the ability to run a hypervisor inside a guest. A host that does not expose it to guests is not in the scenario Kim describes. The second is processor-specific, and it is where this bug differs from Januscape, the KVM escape the same researcher published earlier. On AMD, Kim writes, there is no constraint at all. On Intel the bug can be triggered "only when both EPT page walk length 4 and 5 are exposed to L1".
An attacker also needs root inside the guest they start from. Kim is explicit that "L1 kernel privilege is required", though he notes this is a low bar in the setting he is worried about, because "when you are allocated an instance on a public cloud, you usually have root on your own VM".
The same bug is also a local root
Less obvious from the escape framing is a second impact. On distributions that ship /dev/kvm world-writable at mode 0666, RHEL among them, Kim says an unprivileged local user can use the same flaw as a privilege escalation to gain root, with no virtual machine escape involved at all. That widens the exposure beyond cloud hosts to any affected system where an ordinary user can reach the KVM device node.
Patched upstream, quiet downstream
This was coordinated disclosure with the fix already shipped, not a surprise drop. Kim reported the bug to the kernel security team on 11 July, KVM maintainers wrote a patch two days later, and it was posted and merged upstream on 21 July. The CVE was assigned on 4 August and the report went public on 6 August. The fix, commit 2abd5287f083 in arch/x86/kvm/mmu/mmu.c, makes KVM check for an invalid or obsolete root after making MMU pages available rather than before. Kim dates the vulnerable window from commit f95eec9bed76 on 8 July 2020; the CVE record lists affected kernels from 5.9 up to 6.6.147, 6.12.100, 6.18.41 and 7.1.5, with five stable branches patched.
At the time of writing no distribution advisory has appeared for CVE-2026-64561, so administrators who track kernel issues through their vendor's bulletins rather than upstream may not have seen it yet.
What you should do
- Move to a stable kernel at or above the fixed versions listed in the CVE record.
- Turn on list hardening if it is off. Kim notes that his demo configuration, like Ubuntu's, has CONFIG_DEBUG_LIST, CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION all disabled, and that "if list hardening is turned on, the post-free list write of the current PoC is blocked and a DoS is triggered instead". That turns a host takeover into a crash, which is a considerable improvement while you patch.
- Review whether your guests genuinely need nested virtualization exposed to them.
- Check the permissions on /dev/kvm on any multi-user system.
Kim published proof-of-concept code alongside the report, and is careful about what it is: "not a weaponized exploit that runs immediately in a cloud environment, but demonstration code that reproduces the vulnerability and the full exploit chain on top of QEMU TCG". Using it against a real host would mean moving the guest-side actions into a guest kernel module and porting the exploit to the target's kernel configuration. It was demonstrated only against AMD nested SVM and NPT, on Linux 7.1.3 under emulation, where a successful run leaves a file named /Zapscape owned by root on the host.
There is no evidence of exploitation. No threat actor, campaign or victim is attached to this flaw, and no severity score has been published for it.
Kim's report is on the oss-security mailing list, with the technical write-up and proof-of-concept in his Zapscape repository. IntelFusions has previously covered a Linux kernel bug that let any local user become root and a kernel flaw that sent security vendors checking their own appliances.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.