Zapscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-64561)

tentor

This is a report on "Zapscape (CVE-2026-64561)", a KVM escape vulnerability that lets a guest escape to the host in KVM/x86, that is, on both Intel and AMD hosts.

Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive "zap" path that runs when shadow
pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and
expose nested virtualization, particularly multi-tenant x86 public clouds.

However, unlike the previously published Januscape (CVE-2026-53359), on Intel it can be triggered only when both EPT page walk length 4 and 5 are
exposed to L1. On AMD there is no such constraint.

This vulnerability was reported to [email protected] and is now patched in mainline. It covers the range from f95eec9bed76 (2020-07-08) to
2abd5287f083 (2026-07-21): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083

For detailed information about the vulnerability and follow-up updates, please see: https://zapscape.io

glueckself

To quote the famous bowl of petunias, "Oh no, not again...".

Decicus

Is it too late to become a farmer?

I don't need to kernel patch a cow, for example.

rpqu

fuck

stable_genius

With so many KVM vulnerabilities I guess it will be safer to run everything in qemu CPU emulation mode, no KVM.

Jokes aside, I found one decent use for that.

deafcon

@Decicus said:
Is it too late to become a farmer?

I don't need to kernel patch a cow, for example.

There's got to be a joke about a cow in a corn field in there somewhere, but I can't find it.

Mainfrezzer

The sun is going down!

tentor

People miss the most important remark

it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization

OhJohn

Hey wait, it's not Friday yet.