A hypervisor bug that lets a nested guest escape onto the host machine is now public, with a proof of concept attached. The flaw, called Zapscape and registered as CVE-2026-64561, lives in the shadow page-table machinery KVM/x86 uses to manage memory for nested virtual machines.
The discovery belongs to researcher Hyunwoo Kim, who traced the failure to a stale-root check in the MMU reclaim path. The chain of events: a page fault fires, KVM reclaims shadow pages and invalidates the active root while the handler is still mid-flight, and because nothing revalidates the root, child pages are built beneath a dead one. Later cleanup attaches one page to two lists, frees it, and leaves a dangling reference that enables a post-free write.
Kim’s chain demonstrates the impact by creating a root-owned file on the host. Reaching it requires kernel privileges inside the L1 guest, typically guest root, so hosts exposing nested virtualization to untrusted tenants carry the risk. Intel systems additionally need both EPT page-walk lengths exposed to the guest; AMD has no such condition.
The patch went upstream July 21. Fixed stable kernels are 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Red Hat’s preliminary advisory scores the bug 7.0 out of 10 and labels it CWE-825, an expired pointer dereference.
Kim’s public proof of concept, released August 6, is not a turnkey weapon; deploying it against a real cloud target would mean porting the guest logic into a kernel module and matching the host’s kernel config and memory backend. There is no evidence of in-the-wild attacks. KVM operators exposing nested virtualization to untrusted guests should update and verify coverage via their distribution’s tracker, since vendors often backport fixes without bumping the upstream version string.
