ctipilot.ch

Linux KVM/x86 'Zapscape' — use-after-free in the recursive shadow-MMU zap path gives guest-root-to-host escape (CVSS 8.8); needs nested virtualization, and on Intel EPT page-walk lengths 4 and 5 exposed to L1; fixed upstream 2abd5287f083

cve · CVE-2026-64561

Coverage timeline
1
first 2026-08-08 → last 2026-08-08
Peak priority
high
1 high
Sources cited
2
2 hosts
Sections touched
1
updates
Co-occurring entities
1
see Related entities below
ATT&CK techniques
2
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1068T1611
Affected products
Linux Kernel (KVM/x86)
Tags
cloudpatch-availablepoc-publicpriv-escvulnerabilities

ATT&CK techniques

2 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-08-08/zapscape-cve-2026-64561-kvm-shadow-mmu-second-vm-escape · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-08-08/zapscape-cve-2026-64561-kvm-shadow-mmu-second-vm-escape · ATT&CK page ↗

Story timeline

  1. 2026-08-08CVE-2026-64561 'Zapscape' — a second KVM shadow-MMU use-after-free reaches guest-to-host escape, and Belgium's CCB tells operators to patch immediately
    updatesThe KVM shadow MMU yields a second guest-to-host escape, this one in the recursive zap path, with a public exploitation chain

Where this entity is cited

  • updates1

Source distribution

  • ccb.belgium.be1 (50%)
  • github.com1 (50%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (2)

Entries about Linux KVM/x86 'Zapscape' — use-after-free in the recursive shadow-MMU zap path gives guest-root-to-host escape (CVSS 8.8); needs nested virtualization, and on Intel EPT page-walk lengths 4 and 5 exposed to L1; fixed upstream 2abd5287f083 (1)

2026-08-08 · view entry permalink →

HIGHCVE-2026-64561 +1updateNATOA1

CVE-2026-64561 'Zapscape' — a second KVM shadow-MMU use-after-free reaches guest-to-host escape, and Belgium's CCB tells operators to patch immediately

UPDATE · originally covered CVE-2026-53359 — Linux KVM/x86 "Januscape": shadow-MMU use-after-free enables guest-to-host VM escape on Intel and AMD (2026-07-09)

Januscape has a sibling. Zapscape (CVE-2026-64561) was assigned on 2026-08-04 and is a use-after-free in the same KVM/x86 shadow MMU, but in a different path: where Januscape came from shadow-page role confusion, Zapscape fires when a guest using nested virtualization makes KVM recursively zap a root shadow page that is still in use during MMU page-quota reclaim, leaving KVM handling a fault on a root that has already been invalidated (V4bel, 2026-08-06). The upstream fix, commit 2abd5287f083, moves the stale-root check after make_mmu_pages_available() (V4bel, 2026-08-06).

Belgium's Centre for Cybersecurity turned the pair into a single operational instruction on 2026-08-07, publishing a "Patch Immediately" advisory that treats both CVEs together, scores each CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and states that they "can let an attacker run commands on the host by escaping the guest virtual machine, this can lead to a full system compromise since the attacker can escape the virtual environment" (CCB, 2026-08-07).

Two preconditions decide who is actually exposed, and they differ between the two bugs. Januscape "can be triggered on Intel without any particular constraint as long as nested virtualization is enabled, but Zapscape requires that both EPT page walk length 4 and 5 be exposed to L1 on Intel. On AMD there is no such constraint" (V4bel, 2026-08-06); CCB states Zapscape "can only be exploited by attackers with root privileges and systems with Intel architecture need both EPT page walk length 4 and 5 exposed to L1" (CCB, 2026-08-07). The guest-root precondition sounds like a high bar and often is not: CCB adds that "Distributions like RHEL can allow an unprivileged user to gain root privileges," and on rented cloud instances guest root is simply what the tenant has (CCB, 2026-08-07). The researcher's current public demonstration runs on AMD nested SVM/NPT (V4bel, 2026-08-06).

These two vulnerabilities can let an attacker run commands on the host by escaping the guest virtual machine, this can lead to a full system compromise since the attacker can escape the virtual environment.

This vulnerability can only be exploited by attackers with root privileges and systems with Intel architecture need both EPT page walk length 4 and 5 exposed to L1.

Distributions like RHEL can allow an unprivileged user to gain root privileges.

Centre for Cybersecurity Belgium (CCB) 2026-08-07

can be triggered on Intel without any particular constraint as long as nested virtualization is enabled, but Zapscape requires that both EPT page walk length 4 and 5 be exposed to L1 on Intel. On AMD there is no such constraint.

V4bel — researcher write-up 2026-08-06
vulnerability08 Aug 04:47Zmulti-sourceOpen finding ↗
Sources: Centre for Cybersecurity Belgium (CCB) · V4bel — researcher write-up