Full research report

New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

Zapscape is a well-documented, researcher-disclosed Linux KVM guest-to-host escape with a public proof-of-concept and a coordinated vendor patch process that followed a 26-day responsible disclosure window. The vulnerability's root cause — a stale-root check ordering error in the shadow MMU page fault handler — was introduced when Linux 5.9 added new invariant constraints in 2020, making the flaw approximately five years old in its critical form despite the underlying bookkeeping code originating in 2008. Researcher Hyunwoo Kim has established a consistent and credible pattern of high-impact KVM escape research, publishing three distinct guest-to-host escape CVEs in 2026 across arm64 (CVE-2026-46316), x86 (CVE-2026-53359), and now x86 nested-virtualisation paths (CVE-2026-64561), each with public proofs-of-concept. The exploitation bar is meaningfully elevated by the requirement for guest kernel-level access, the nested-virtualisation prerequisite, and the researcher's own acknowledgement that cloud-environment exploitation requires per-host adaptation rather than a drop-in payload. The most urgent exposure belongs to cloud and hosting providers running x86 KVM with nested virtualisation exposed to tenants, where the guest root precondition is routinely satisfied by default.

What happened

On 6 August 2026, security researcher Hyunwoo Kim publicly disclosed Zapscape (CVE-2026-64561), a use-after-free vulnerability in the Linux kernel's KVM/x86 shadow MMU that allows a privileged L1 guest to escape hypervisor isolation and execute code on the host. The flaw was introduced in Linux 5.9 in 2020 and stems from a stale-root check that runs before, rather than after, shadow page reclamation, allowing child pages to be mapped under an invalidated root. Kim reported the issue to the kernel security team on 11 July 2026; the patch was merged on 21 July and fixed stable releases were available before the 6 August public disclosure. This is the third KVM escape published by Kim in 2026, following ITScape (CVE-2026-46316, KVM/arm64) in June and Januscape (CVE-2026-53359, KVM/x86) in July.

Affected scope

Linux kernel versions 5.9 through 7.1.5 on KVM/x86 hosts that expose nested virtualisation to untrusted guests. Fixed stable releases are 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. As of 6 August 2026, Debian bullseye, bookworm, trixie, and forky standard kernel packages remain vulnerable; only trixie-security (6.12.101-1) and sid (7.1.6-1) carry fixes. Red Hat packages may contain backported fixes not reflected in upstream version strings. Intel hosts additionally require both EPT page-walk lengths 4 and 5 to be exposed to the L1 guest; AMD SVM has no equivalent prerequisite.

Technical assessment

The vulnerability is a sequencing error in KVM's page fault handler: the handler checks root-page validity before calling make_mmu_pages_available(), which can itself invalidate that same root during shadow page reclamation. When reclaim invalidates the in-use root, the handler continues building child shadow pages under it without re-validating, placing those invalid children on KVM's active MMU page list. This creates a list-link double-membership condition that yields a post-free write primitive when KVM subsequently inserts another shadow page. The researcher's proof-of-concept chains this primitive through cross-cache corruption into the guest_memfd allocator, pointer leaks via corrupted list structures, KASLR disclosure, and control-flow hijack via workqueue corruption. The upstream fix (commit 2abd5287f083) moves the stale-root check to after make_mmu_pages_available() and issues RET_PF_RETRY when the root has been invalidated, preventing invalid children from entering the active list.

Recommended defensive actions

  1. Apply updated kernel packages (fixed at 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5) as the primary mitigation; on Red Hat-based systems, verify backported fixes by inspecting rpm -q --changelog kernel before assuming the upstream version string is sufficient.
  2. Disable or restrict nested virtualisation exposure to untrusted guests to remove the required attack surface for this class of KVM/x86 shadow-MMU exploitation.
  3. Audit all KVM hosts in your environment for nested virtualisation exposure, prioritising multi-tenant infrastructure and public-facing hypervisors where guest kernel access is granted by default.
  4. Monitor vendor security trackers (Red Hat, Debian, Ubuntu, SUSE) for product-specific advisories and patch timelines, as backport schedules vary and most Debian releases remain unpatched as of the disclosure date.
  5. Inventory all three CVEs in this KVM escape series (CVE-2026-46316, CVE-2026-53359, CVE-2026-64561) and confirm each has been independently addressed; they affect different KVM subsystems and require separate patch validation.

Uncertainties and evidence gaps

  • Red Hat has not yet published patched package versions or confirmed affected product lines beyond the preliminary CVSS advisory.
  • NVD had not completed CVSS scoring for CVE-2026-64561 as of the 6 August 2026 disclosure date.
  • The exploit's practical success rate against hardened cloud-provider kernel configurations is unknown; the researcher explicitly states that adaptation to specific host kernel configurations and memory backends is required.
  • Debian bullseye, bookworm, and forky fix timelines have not been published; those releases have not yet received security-repository updates.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessKernel-level (root) access within an L1 guest virtual machine; the host must have nested virtualisation enabled and exposed to the guest
ComponentKVM/x86 shadow MMU page fault handler (arch/x86/kvm/mmu/mmu.c), specifically the shadow page reclamation and root-validity sequencing logic
MechanismA check-before-reclaim ordering error allows shadow page reclamation to invalidate the active MMU root after validity has already been confirmed; invalid child pages are subsequently added to the active page list, producing a dangling list-link condition that results in a post-free write
ImpactHost kernel memory corruption yielding arbitrary code execution with root privileges on the hypervisor host, with consequent exposure of all co-resident guest virtual machines
DetectionNo lightweight runtime indicator has been published; kernel audit logging of anomalous KVM MMU state transitions may surface evidence of an active exploitation attempt in verbose kernel logging configurations
MitigationApply kernel fix commit 2abd5287f083 or update to a fixed stable release (6.6.148 / 6.12.101 / 6.18.42 / 7.1.6 / 7.2-rc5); alternatively, disable nested virtualisation for untrusted guests
Exploitation status

No confirmed in-the-wild exploitation; a public proof-of-concept targeting AMD nested SVM/NPT on Linux 7.1.3 is available, but the researcher states it is not immediately weaponisable in cloud environments without guest-kernel-module adaptation and per-host configuration tuning.

Research process

Investigation began with the THN article claiming a new KVM guest-to-host escape with a public proof-of-concept. Primary sources — the researcher's GitHub repository, technical write-up, NVD, Red Hat advisory, and Debian security tracker — all confirmed the core claims and provided independent corroboration across five distinct domains. The researcher's own write-up confirmed both the technical mechanism and the exploitation caveats, meaningfully informing the risk assessment. Two prior disclosures by the same researcher (Januscape and ITScape) were independently confirmed via NVD and multiple industry reporting sites, establishing a credible pattern of focused KVM shadow-MMU research by Hyunwoo Kim in 2026.

  1. What does the THN article actually claim about Zapscape, and does it reference primary sources?
    Fetched the THN article to extract factual claims, researcher identity, CVE numbers, affected versions, patch details, and URLs to primary sources.
    thehackernews.com ↗

    Article confirmed CVE-2026-64561, researcher Hyunwoo Kim, shadow-MMU use-after-free root cause, public PoC on GitHub, patch commit 2abd5287f083, Red Hat CVSS 7.0, and Debian vulnerability status. References to GitHub, NVD, and Red Hat advisory provided.

    why Establishes the baseline claims requiring independent verification; THN is treated as untrusted secondary reporting requiring corroboration.

  2. Is the CVE independently searchable, and does a genuine GitHub PoC repository exist?
    Searched for CVE-2026-64561 and Zapscape across public sources.

    Multiple independent sites including LowEndTalk, NVD, and Red Hat confirm the CVE. The V4bel/Zapscape GitHub repository is real and attributed to researcher @v4bel.

    why Independent corroboration from separate domains strengthens confidence in the core claim before fetching primary sources.

  3. What does the researcher's own repository disclose about the vulnerability scope and PoC nature?
    Fetched the V4bel/Zapscape GitHub repository.
    github.com ↗

    Repository confirms use-after-free in shadow MMU, a three-level L0/L1/L2 escape chain, AMD SVM/NPT target on Linux 7.1.3, and notes the vulnerable code spans commits from July 2020 to the July 2026 fix.

    why Primary researcher source confirms the vulnerability scope and PoC existence independent of secondary reporting.

  4. What does the researcher's technical write-up say about root cause, fix, and exploitation limitations?
    Fetched the researcher's write-up from the GitHub assets folder.
    github.com ↗

    Write-up confirms the stale-root check ordering error, post-free write primitive mechanism, full exploitation chain stages, and that the fix reorders the validity check after make_mmu_pages_available() with RET_PF_RETRY. Researcher states real-world use requires adaptation to host configuration.

    why Direct researcher disclosure validates the technical mechanism and confirms the exploitation bar, which is material to the risk assessment for defenders.

  5. What severity and fix status does Red Hat assign, and are backport caveats documented?
    Fetched the Red Hat security advisory for CVE-2026-64561.
    access.redhat.com ↗

    CVSS 7.0 High (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-825. Advisory is preliminary; Red Hat explicitly cautions that backported fixes may not be reflected in upstream version strings.

    why Vendor advisory confirms severity and highlights an operationally important caveat for defenders running RHEL or derivative distributions.

  6. Which Debian releases are currently vulnerable and which have received fixes?
    Fetched the Debian security tracker entry for CVE-2026-64561.
    security-tracker.debian.org ↗

    Bullseye, bookworm, trixie, and forky standard kernel packages are vulnerable. Only trixie-security (6.12.101-1) and sid (7.1.6-1) are fixed; no timeline published for remaining releases.

    why Confirms that the majority of production Debian systems require immediate attention and that fix availability is limited to specific repository tiers.

  7. What do NVD records confirm about the affected version range and fix commits?
    Fetched the NVD detail page for CVE-2026-64561.
    nvd.nist.gov ↗

    NVD confirms Linux 5.9 as the first affected version, lists five fix commits across stable branches (including 2abd5287f083), and gives fixed releases as 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. CVSS not yet assessed by NVD.

    why Authoritative US government vulnerability database independently validates the affected version range and fix commits, providing a reliable reference for patch validation.

  8. Are CVE-2026-53359 (Januscape) and CVE-2026-46316 (ITScape) genuine prior disclosures by the same researcher, as the article claims?
    Searched for Januscape and CVE-2026-53359; fetched the NVD detail page for CVE-2026-53359; reviewed ITScape search results for CVE-2026-46316.
    nvd.nist.gov ↗

    NVD confirms CVE-2026-53359 as a Linux KVM shadow-MMU use-after-free (CVSS 8.8 High, CWE-416) affecting Linux 2.6.36 through 7.1.2, now patched. Multiple independent sources including CloudLinux, SecurityWeek, and TuxCare confirm Hyunwoo Kim as researcher. CVE-2026-46316 (ITScape, KVM/arm64 vgic-its, CVSS 9.3 Critical) is confirmed across oss-security, CIQ, and LowEndTalk search results, attributed to the same researcher.

    why Confirms the article's characterisation of Zapscape as the third in a series of 2026 KVM escape disclosures by Kim, validating the stated related CVEs and establishing the broader research context.

Named in this story
ActorsHyunwoo Kim (@v4bel) — security researcher and disclosing party
TargetsLinux KVM/x86 hypervisor hosts with nested virtualisation enabledMulti-tenant x86 public cloud infrastructureKVM/arm64 hosts (prior disclosure ITScape, CVE-2026-46316)
Related CVEs CVE-2026-64561CVE-2026-53359CVE-2026-46316

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
NVDcve ok900 records Primary evidence2 matched items Supplied a vendor or government advisory opened and verified during focused research. Supplied independent analysis opened and verified during focused research.
The Hacker Newsnews ok14 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1661 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5321 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok675 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1007 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Technical references1
github.com/V4bel/Zapscape/blob/main/assets/write-up.md ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code2
Zapscape: Guest-to-Host Escape in KVM/x86 — GitHub Repository (V4bel/Zapscape) github.com ↗

Official PoC repository by researcher Hyunwoo Kim; demonstrates a three-level L0/L1/L2 escape chain on AMD nested SVM/NPT

Zapscape Technical Write-up (researcher-authored) github.com ↗

Detailed root-cause analysis and disclosure timeline; confirms exploitation requires host-specific adaptation

Vendor & gov advisories3
CVE-2026-64561 — Red Hat Security Advisory access.redhat.com ↗

Preliminary CVSS 7.0 High (AV:L/AC:H/PR:L/UI:N/S:U); CWE-825; advises checking changelogs rather than version strings for backported fixes

CVE-2026-64561 — Debian Security Tracker security-tracker.debian.org ↗

Confirms bullseye, bookworm, trixie, and forky standard packages remain vulnerable; only trixie-security (6.12.101-1) and sid (7.1.6-1) are fixed

CVE-2026-64561 Detail — NVD nvd.nist.gov ↗

Lists affected range from Linux 5.9 and documents five fix commits across stable branches; CVSS not yet assessed by NVD

Analysis & research2
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts — The Hacker News thehackernews.com ↗

Primary news report with researcher attribution, exploitation caveats, and Debian/Red Hat patch status as of disclosure date

CVE-2026-53359 (Januscape) Detail — NVD nvd.nist.gov ↗

Confirms prior KVM/x86 shadow-MMU escape by the same researcher; CVSS 8.8 High, CWE-416; corroborates the series pattern