Ethical Hacking News
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts: A Critical Security Alert
A recent vulnerability was uncovered in the Linux kernel's Virtual Machine (KVM) system, allowing an attacker with kernel privileges inside an L1 guest virtual machine to escape KVM isolation and execute code on the host. This critical security alert highlights the importance of staying vigilant and proactive when it comes to protecting against new vulnerabilities and exploits.
A new vulnerability was uncovered in the Linux kernel's KVM system (CVE-2026-64561), allowing an attacker with kernel privileges to escape isolation and execute code on the host.The flaw is due to a stale-root check ordering issue in KVM's shadow-MMU bookkeeping mechanism, which allows for a use-after-free vulnerability.The vulnerability affects various distributions and vendors beyond Linux systems and can bypass traditional security measures.Administrators are advised to update to a fixed stable kernel or a vendor package that backports the patch to mitigate this vulnerability.
In a recent discovery that has sent shockwaves through the cybersecurity community, a new vulnerability was uncovered in the Linux kernel's Virtual Machine (KVM) system. The flaw, tracked as CVE-2026-64561, poses a significant risk to systems that utilize KVM for virtualization, allowing an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host.
This vulnerability is particularly concerning due to its ability to bypass traditional security measures. According to Hyunwoo Kim, the researcher who disclosed the bug, the demonstrated exploit path can run commands on the host with kernel or root privileges. The impact of this flaw is not limited to Linux systems alone, as it affects various distributions and vendors.
The vulnerability arises from a stale-root check ordering flaw in KVM's shadow-MMU bookkeeping mechanism. During guest-triggered page fault handling, KVM can reclaim MMU pages and invalidate the shadow MMU root page still being used by the fault-handling path. Because the path does not check the root again, KVM can continue under the invalidated root.
The lack of a stale-root check after reclaiming MMU pages allows an attacker to create a use-after-free vulnerability. This means that even though the root page has been invalidated, KVM still continues to map or fetch code under it, effectively allowing the attacker to execute arbitrary code on the host.
Swati Khandelwal of The Hacker News broke down the issue further in her article, explaining that this is a use-after-free bug. Kim's public proof-of-concept uses that primitive to build a full chain that creates a root-owned file named /Zapscape on the host running the vulnerable KVM.
This vulnerability has significant implications for system administrators and developers who rely on KVM for their virtualization needs. According to Swati Khandelwal, Kim recommends running the proof-of-concept under QEMU TCG for safe testing. However, she also notes that the bug lives in in-kernel KVM and is triggered independently of QEMU's emulation.
To mitigate this vulnerability, administrators are advised to update to a fixed stable kernel or a vendor package that backports the patch. The required L1 kernel privilege usually means guest root. Intel systems also require both EPT page-walk length 4 and 5 to be exposed to the L1 guest.
This recent discovery is part of a broader trend in the world of cybersecurity, highlighting the importance of staying vigilant and proactive when it comes to protecting against new vulnerabilities and exploits.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Zapscape-KVM-Flaw-Could-Let-Privileged-L1-Guest-Code-Escape-to-Linux-Hosts-A-Critical-Security-Alert-ehn.shtml
https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-64561
https://www.cvedetails.com/cve/CVE-2026-64561/
Published: Thu Aug 6 13:45:41 2026 by llama3.2 3B Q4_K_M
