CVE-2026-64561Disclosure

💥 Introducing "Zapscape" (CVE-2026-64561) A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU's recursive "ZAP" path. Can escape to the host on x86 public clouds that expose nested virtualization. A separate vulnerability from Januscape. If you match the vulnerable conditions, apply the patch immediately. Details: https://zapscape.io

‼️ New Linux KVM escape flaw disclosed with public PoC. Zapscape (CVE-2026-64561) could let an attacker with guest root break out of a nested VM and execute code as root on the host when nested virtualization is exposed to untrusted guests. Learn which KVM setups are exposed: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html

لينكس مبدعين هالشهر ومتفوقين على ويندوز 😁 ثغرة جديدة في KVM اسمها Zapscape رقمها CVE-2026-64561 تسمح لمخترق عنده صلاحيات root داخل جهاز افتراضي يهرب من الـ VM وينفذ كود بصلاحيات root على السيرفر المضيف نفسه 😬 https://t.co/HzK9aSsrav

A PoC/exploit has been discovered for vulnerability CVE-2026-64561 Vendor: Linux Product: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately. Link: https://github.com/V4bel/Zapscape #dbugs_vuln

CVE-2026-64561 Zapscape permite a invitados KVM escapar al host Linux con privilegios root Se ha descubierto una vulnerabilidad en el núcleo de Linux llamada Zapscape (CVE-2026-64561) https://blog.elhacker.net/2026/08/cve-2026-64561-zapscape-permite.html

🚨 Linux KVM'de yeni kritik VM Escape açığı duyuruldu ve PoC yayınlandı! Zapscape (CVE-2026-64561) adı verilen yeni güvenlik açığı, duyurulduktan bir kaç gün sonra PoC GitHub'da kamuya açık olarak paylaşıldı. PoC: https://github.com/V4bel/Zapscape Açık, nested virtualization etkin olan KVM sistemlerinde, guest root yetkisine sahip bir saldırganın sanal makineden çıkarak host üzerinde root yetkisiyle kod çalıştırabilmesine olanak tanıyor. 🔹 CVE: CVE-2026-64561 🔹 Etkilenen: Linux KVM/x86 🔹 PoC: Yayınlandı 🔹 Risk: VM Escape -> Host Root KVM tabanlı sanallaştırma kullanan sistem yöneticileri güvenlik güncellemelerini ve nested virtualization yapılandırmalarını mutlaka gözden geçirmeli.

Un nuevo fallo de seguridad en el kernel de Linux, conocido como Zapscape, podría permitir a un atacante con privilegios de kernel dentro de una máquina virtual escapar de la isolación KVM y ejecutar código en el host. El fallo es tracked como CVE-2026-64561 y afecta KVM/x86's shadow memory management unit (MMU), lo que podría permitir a un atacante con privilegios de kernel dentro de una máquina virtual escapar de la isolación KVM y ejecutar código en el host. El impacto de este fallo es crítico, ya que podría permitir a un atacante acceder a información confidencial y tomar control de la máquina host. Los sistemas que utilizan KVM/x86 y tienen habilitada la virtualización anidada están en riesgo. ¿Hay parche? La comunidad de Linux ya está trabajando en un parche para solucionar este problema. Mientras tanto, los administradores de sistemas deben revisar sus configuraciones de KVM y considerar deshabilitar la virtualización anidada hasta que se disponga de un parche. ¿Estás en riesgo? Revisa esto: verifica si tus sistemas utilizan KVM/x86 y si tienen habilitada la virtualización anidada. Si es así, considera deshabilitarla hasta que se disponga de un parche. #Ciberseguridad #CVE #SeguridadDigital #Threat https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html

اگر از مجازی ساز KVM استفاده می کنید و Nested Virtualization فعال هست، آسیب پذیری با عنوان Zapscape و CVE-2026-64561 منتشر شده به مهاجم از داخل VM که فلگ پردازنده به صورت Host تنظیم شده اجازه دسترسی میده که به ماشین اصلی دسترسی پیدا کنه. کرنل را به روز کنید و اگر از Nested استفاده نمی کنید آن را غیرفعال کنید.

CVE-2026-64561,Zapscape: Linux kernel: Guest-to-Host Escape in KVM/x86 https://www.openwall.com/lists/oss-security/2026/08/06/6 UAF in the shadow MMU emulation, specifically in the recursive "zap" path that runs when shadow pages are reclaimed. Exploit included.

PoC exploit code is public for CVE-2026-64561 (Zapscape), a KVM escape that runs commands with kernel root privilege on the host. Details inside. #KVM #Linux #CVE #Virtualization #CyberSecurity http://securityonline.info/kvm-escape-vulnerability-zapscape/

Nested virtualization keeps proving it’s a high-risk playground. A new Linux KVM flaw called Zapscape (CVE-2026-64561) lets an attacker with root inside a nested guest punch through to the actual host via a use-after-free in the shadow memory manager. Not the easiest exploit in the wild yet, but any environment that hands nested virt to untrusted VMs should be treating this as urgent. Patch early. https://www.cysecurity.news/2026/08/new-zapscape-linux-kvm-vulnerability.html

KVM/x86のゲストからホストへ脱出し、ホストカーネル権限で任意コードを実行できる脆弱性「Zapscape」（CVE-2026-64561）のPoCが公開された。影響はネスト仮想化を提供する環境に及び、マルチテナント型のx86クラウドではゲスト間分離が破られる可能性がある。 ZapscapeはKVM/x86のシャドウMMUに存在するUse-After-Freeで、シャドウページ回収時の再帰的なzap処理に起因する。攻撃者はゲスト側の操作だけでホストカーネルのシャドウページを破壊し、root権限のコード実行へつなげられる。公開PoCはAMD向けで、Linux 7.1.3とKVM_AMDをQEMU TCG上で動かす構成を想定する。L1ゲストがlong modeからPAEへ切り替えて同一ページを別用途で参照し、L2のメモリアクセスでクォータ回収を起こすことでUAFを誘発する。成功するとホスト側にroot所有の「/Zapscape」ファイルが作成される。影響範囲は2020年7月8日から2026年7月21日までの変更を含むカーネルで、公開クラウドではゲストroot権限を持つ利用者がホストや同一物理マシン上の他VMを侵害できる可能性がある。 https://github.com/V4bel/Zapscape

Descubierta una nueva vulnerabilidad que afecta a los hipervisores #Proxmox VE, Zapscape (CVE-2026-64561). https://github.com/V4bel/Zapscape

CVE-2026-64561 Zapscape permite a invitados KVM escapar al host Linux con privilegios root https://blog.elhacker.net/2026/08/cve-2026-64561-zapscape-permite.html #Internet #Noticia #Tecnología #CiberSeguridad vía @elhackernet https://t.co/XPgm2Jt1ju

@osmanmakal CVE-2026-64561 sanırım bahsi geçen olay, AI sayesinde/yüzünden belki de senelerce kimsenin fark etmeyeceği zafiyetler gün yüzüne çıkıyor. İyi mi kötü mü bilemedim

LinuxのKVMエスケープ脆弱性"Zapscape" (CVE-2026-64561)がPoC（攻撃の概念実証コード）付きで開示された。CVSSスコアはまだない。カーネルroot権限取得可能。KVM shadow MMUにおける解放後メモリ使用。 https://securityonline.info/kvm-escape-vulnerability-zapscape/

🚨 PoC RELEASED: CVE-2026-64561, a Linux kernel KVM/x86 vulnerability, now has public exploit code. The flaw involves stale/invalid MMU roots and can cause KVM to create invalid shadow pages, violating core MMU invariants and potentially leading to kernel memory corruption. The underlying issue dates back to 2008, while the problematic invariant was introduced in Linux 5.9. 🔗 PoC: https://github.com/V4bel/Zapscape #Linux #Kernel #KVM #CVE #PoC #CyberSecurity #Infosec

A new Linux Kernel KVM vulnerability threatens cloud servers with virtual machine escape risks. Learn about CVE-2026-64561 and secure your host machine now. #LinuxKernel #KVMVulnerability #CVE202664561 #CloudSecurity #VMescape http://securityexpress.info/linux-kernel-kvm-vulnerability/

Zapscape、名前がいいのが余計に怖い。CVE-2026-64561、KVM/x86のシャドウMMUで再帰的なZAP処理がUAFを起こし、L1ゲストの特権コードがホストへ脱出できる。効くのはネステッド仮想化を晒したx86パブリッククラウド全部。 使ってないなら切る、使ってるならパッチ状況を今すぐ確認した方がいい。 ソース: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html

🔴 CVE-2026-64561 (Zapscape) ardından Linux KVM'de yeni bir nVMX açığı daha ortaya çıktı: CVE-2026-68081 Nested VM-Enter işlemi geçersiz guest state nedeniyle başarısız olduğunda "vmcs12" sayfalarının düzgün serbest bırakılmaması sonucu kaynak/sayfa sızıntısına yol açıyor. Özellikle nested virtualization kullanan KVM hostlar için kernel güncellemesi öneriliyor.