Zapscape (CVE-2026-64561): A 6-Year-Old KVM Vulnerability Enables VM Escape to Linux Host

Since 2020, a bug in the KVM/x86 shadow MMU allowed an attacker with kernel privileges in a guest VM to escape to the host or escalate privileges locally via /dev/kvm.

What happened

A silent vulnerability has just been disclosed under the name Zapscape, tracked as CVE-2026-64561. Present in the Linux kernel's KVM/x86 code since 2020—six years ago—it allows an attacker with kernel privileges inside a guest virtual machine (L1) to escape KVM isolation and execute code directly on the host.

The flaw lies in KVM's shadow Memory Management Unit (MMU), which manages shadow page tables—the page tables the hypervisor maintains to translate guest virtual addresses into host physical addresses. A change introduced in 2020 in the KVM/x86 code created an exploitable condition in this mechanism.

Who is affected?

Two distinct exploitation scenarios:

1. Guest-to-host escape – The attacker must have kernel privileges inside an L1 VM, and nested virtualization (nested virtualization) must be exposed to untrusted guests. This is the most restrictive condition, but also defines the scale of risk in shared cloud environments: a compromised VM can become an entry point to the entire physical server and all VMs running on it.

2. Local Privilege Escalation (LPE) – On certain Linux distributions like RHEL, /dev/kvm is world-writable. In this case, Zapscape can be used as a local privilege escalation vector without requiring nested virtualization.

Any Linux distribution with KVM/x86 enabled is potentially affected. Cloud environments that expose nested virtualization to untrusted tenants are at the highest risk.

What this means in practice

Zapscape falls into the particularly serious category of KVM escapes: breaking isolation between a guest and its host is one of the most feared threats in cloud infrastructures. It allows moving from a compromised VM to the entire physical server—and all VMs running on it.

Environments at highest risk: cloud providers, CI/CD environments with ephemeral VM runners, and test labs with nested virtualization enabled.

The flaw has been present since 2020. Six years in such a critical layer, undetected publicly—this warrants auditing /dev/kvm permissions and verifying nested virtualization configurations on exposed systems.