All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Zapscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-64561)
This is a report on "Zapscape (CVE-2026-64561)", a KVM escape vulnerability that lets a guest escape to the host in KVM/x86, that is, on both Intel and AMD hosts.
Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive "zap" path that runs when shadow
pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and
expose nested virtualization, particularly multi-tenant x86 public clouds.However, unlike the previously published Januscape (CVE-2026-53359), on Intel it can be triggered only when both EPT page walk length 4 and 5 are
exposed to L1. On AMD there is no such constraint.This vulnerability was reported to [email protected] and is now patched in mainline. It covers the range from f95eec9bed76 (2020-07-08) to
2abd5287f083 (2026-07-21): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083For detailed information about the vulnerability and follow-up updates, please see: https://zapscape.io
Comments
To quote the famous bowl of petunias, "Oh no, not again...".
Is it too late to become a farmer?
I don't need to kernel patch a cow, for example.
fuck
With so many KVM vulnerabilities I guess it will be safer to run everything in qemu CPU emulation mode, no KVM.
Jokes aside, I found one decent use for that.
There's got to be a joke about a cow in a corn field in there somewhere, but I can't find it.
The sun is going down!
People miss the most important remark
Hey wait, it's not Friday yet.
And there is also this beauty, CVE-2026-64564, an LPE via SCTP, including container-to-host escape
Seems to be every week at this point..
Seems debian is the fastest distro to move to have patches ready, they already have a patched source (6.12.101-1) you can compile yourself.
Great, more maintenance windows and reboots.
Now I do think running qemu cpu does helps xD instead of running host mode.
Interesting that JanuScape caused such a stir in here, while this actual escape-to-host exploit gets almost no attention. It is clearly the more severe of the two, since JanuScape only allowed a host crash at the time. We love AI don’t we?
Maybe people are already becoming desensitized
It's a new era
@Computebox was fast again last night.
Still waiting for OVH to put up a new maintenance notice for 700+ different OVH cloud services...
eh its nothing special really. All you need to do is update to 6.18.42 or 6.12.101 and done. Would be more captivating if there wasnt a fix. More novel exploits are certainly something. Always good getting found and fixed.
Confirmed, I don't need to patch my chickens
this shit is super annoying but preferable to only the bad guys knowing about it.