Zapscape KVM Vulnerability (CVE‑2026‑64561) Threatens Linux Hosts

A critical flaw identified as CVE‑2026‑64561, dubbed “Zapscape,” affects the KVM/x86 shadow Memory Management Unit (MMU) in the Linux kernel. The use‑after‑free bug in shadow‑MMU emulation can be triggered during nested virtualization when a guest with kernel‑level privileges manipulates shadow page tables, allowing a virtual machine escape that gives the attacker arbitrary code execution on the host.

The vulnerability primarily targets multi‑tenant cloud environments, high‑performance‑computing clusters, and other enterprise virtualization infrastructures that enable nested virtualization. On Red Hat‑based distributions, permissive /dev/kvm permissions (mode 0666) may broaden the attack surface. Vendors are urged to apply patches to KVM and the Linux kernel immediately and to review nested‑virtualization settings.

Researchers, including Hyunwoo Kim, have demonstrated proof‑of‑concept exploits on both Intel and AMD platforms, noting that the attack is feasible with root access inside the guest VM. Mitigation steps include disabling unnecessary nested virtualization, updating kernel packages, and tightening device permissions.