Zapscape (CVE-2026-64561) is another reminder that the hypervisor boundary is only as strong as the code implementing it.
The vulnerability is a guest-to-host escape in Linux KVM's x86 Shadow MMU. The root cause is a stale-root validation ordering bug that allows the page fault handler to continue using an invalidated shadow MMU root after quota reclaim, ultimately leading to a use-after-free primitive. Public research demonstrates a complete guest-to-host escape chain, although exploitation requires privileged code execution inside an L1 guest and nested virtualization exposure.
I put together a deep technical analysis covering the Shadow MMU internals, nested virtualization, exploitation stages, cross-cache reallocation, KASLR bypass, AMD vs. Intel trigger conditions, the upstream fix, and why simply moving a stale-root check eliminates the entire exploitation chain.
Interested to hear how others assess the practical risk for multi-tenant KVM deployments where nested virtualization is enabled.
https://thecybersecguru.com/news/zapscape-cve-2026-64561-kvm-guest-host-escape/
#Linux #KVM #Virtualization #KernelSecurity #CloudSecurity #CVE202664561
