**Zapscape** is a stale-root check ordering flaw residing in **KVM/x86**'s shadow Memory Management Unit (MMU). This component is responsible for managing the shadow page tables used for nested guest memory translation. ### The Mechanics of the Flaw Security researcher **Hyunwoo Kim**, who disclosed the bug, demonstrated an exploit path capable of running commands on the host with kernel, or root, privileges. The vulnerability, tracked as **CVE-2026-64561**, is a use-after-free issue within KVM's shadow-MMU bookkeeping. During guest-triggered page fault handling, KVM can reclaim MMU pages and inadvertently invalidate a shadow MMU root page that is still in use by the fault-handling path. Crucially, the system fails to re-check the root's validity, allowing KVM to continue operations under the invalidated root. In a [technical write-up](https://github.com/V4bel/Zapscape/blob/main/assets/write-up.md), Kim explained that this leads to child shadow pages inheriting an invalid state from their parent. These invalid child pages are still placed on KVM's active MMU page list. Subsequent cleanup operations can then attach the same list link to two lists simultaneously, causing the page to be freed while stale list references persist. This creates a dangling link, enabling a post-free write primitive. ### Proof-of-Concept and Exploitation Conditions Kim's public **proof-of-concept (PoC)** leverages this primitive to construct a full chain that creates a root-owned file named `/Zapscape` on the vulnerable KVM host. The PoC specifically targets **AMD** nested **SVM/NPT** on **Linux 7.1.3**. It's important to note that the required L1 kernel privilege typically means guest root access. For **Intel** systems, both EPT page-walk lengths 4 and 5 must also be exposed to the L1 guest; **AMD** systems do not have this equivalent condition. While the PoC is publicly available, it has not been observed in the wild. Kim clarified that it is "not a weaponized exploit that runs immediately" in typical cloud environments. Real-world exploitation would necessitate adapting L1 actions into a guest kernel module and tailoring the exploit to specific host kernel configurations and memory backends. ### Affected Versions and Remediation The [National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-64561) lists **Linux 5.9** and later as affected until fixed stable releases, including **6.6.148**, **6.12.101**, **6.18.42**, **7.1.6**, and **7.2-rc5**. **Red Hat** has assigned a preliminary CVSS score of 7.0 and categorized the issue as **CWE-825** (expired pointer dereference). Organizations running KVM hosts that expose nested virtualization to untrusted guests are strongly advised to update to a fixed stable kernel or a vendor-provided package that backports the patch. As of August 6, 2026, **Debian**'s tracker indicated that `bullseye`, `bookworm`, `trixie`, and `forky` kernel packages were vulnerable, while `sid` was fixed at `7.1.6-1`. ### Disclosure Timeline and Fix **Hyunwoo Kim** reported the issue to `[email protected]` on July 11, 2026. A patch was posted and merged on July 21, followed by submission to the `linux-distros` list on August 1 under a five-day embargo. **CVE-2026-64561** was assigned on August 4, with public disclosure on August 6. The fix, merged as commit `2abd5287f083`, addresses the vulnerability by moving the stale-root check after `make_mmu_pages_available()`. If reclaim invalidates the current root, KVM now restarts the fault with `RET_PF_RETRY` instead of continuing to map or fetch under the invalid root. This disclosure follows Kim's previous notable work on KVM vulnerabilities, including **Januscape** (**CVE-2026-53359**), another KVM/x86 shadow-MMU issue, and **ITScape** (**CVE-2026-46316**), a KVM/arm64 escape.