Zapscape: KVM Shadow MMU Flaw Allows L1 Guest Escape to Linux Host Root

A critical use-after-free vulnerability in the Linux kernel's KVM/x86 shadow Memory Management Unit (MMU) could allow a privileged guest virtual machine to escape its isolation. The flaw, tracked as CVE-2026-64561 and dubbed "Zapscape," enables an attacker with kernel privileges in an L1 guest to execute arbitrary code with root privileges on the underlying Linux host.

According to technical documentation from researcher V4bel, the vulnerability triggers during MMU page quota reclaim. Specifically, the flaw occurs when KVM recursively "zaps" a root shadow page that is still in use. This creates a use-after-free (UAF) condition that an attacker can leverage to compromise the host. The exploit chain involves establishing a dangling link and performing a post-free write, which allows the attacker to obtain the KASLR slide and ultimately achieve host code execution.

The Role of Nested Virtualization

KVM serves as the standard virtualization module for the Linux kernel, utilizing the shadow MMU to manage memory translation for guest machines. The risk associated with Zapscape is significantly amplified when nested virtualization is enabled. Nested virtualization allows a guest VM to function as a hypervisor for its own secondary (L2) guests. While this provides flexibility for developers and cloud architects, it introduces immense complexity into memory management and substantially expands the attack surface, creating the specific conditions necessary for this guest-to-host escape.

Implications for Cloud Infrastructure

VM escapes represent one of the most severe security failures in cloud computing because they dismantle the primary boundary between tenants. If a malicious actor successfully escapes a guest VM to the host, they can potentially access sensitive data from every other VM residing on that physical server. By compromising the hypervisor, an attacker gains full control over the underlying infrastructure. This poses a particular risk to public cloud providers that offer nested virtualization features, as a single compromised L1 guest could lead to a total breach of the host environment.

Next Steps for Administrators

Security teams should prioritize auditing environments where nested virtualization is exposed to untrusted guests. While the core mechanics of the UAF flaw are confirmed, administrators should monitor for official kernel patches addressing CVE-2026-64561. Until such updates are applied, restricting the use of nested virtualization for high-risk workloads remains the most effective mitigation strategy to prevent potential host-level compromises.