All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Zapscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-64561)
This is a report on "Zapscape (CVE-2026-64561)", a KVM escape vulnerability that lets a guest escape to the host in KVM/x86, that is, on both Intel and AMD hosts.
Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive "zap" path that runs when shadow
pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and
expose nested virtualization, particularly multi-tenant x86 public clouds.However, unlike the previously published Januscape (CVE-2026-53359), on Intel it can be triggered only when both EPT page walk length 4 and 5 are
exposed to L1. On AMD there is no such constraint.This vulnerability was reported to [email protected] and is now patched in mainline. It covers the range from f95eec9bed76 (2020-07-08) to
2abd5287f083 (2026-07-21): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083For detailed information about the vulnerability and follow-up updates, please see: https://zapscape.io
Comments
To quote the famous bowl of petunias, "Oh no, not again...".
Is it too late to become a farmer?
I don't need to kernel patch a cow, for example.
fuck
With so many KVM vulnerabilities I guess it will be safer to run everything in qemu CPU emulation mode, no KVM.
Jokes aside, I found one decent use for that.
There's got to be a joke about a cow in a corn field in there somewhere, but I can't find it.
The sun is going down!
People miss the most important remark
Hey wait, it's not Friday yet.
And there is also this beauty, CVE-2026-64564, an LPE via SCTP, including container-to-host escape