Zapscape (CVE-2026-64561): A 6-Year-Old KVM Vulnerability Enables VM Escape to Linux Host

Since 2020, a bug in the KVM/x86 shadow MMU allowed an attacker with kernel privileges in a guest VM to escape to the host or escalate privileges locally via /dev/kvm.

Aug 8, 2026 11 3