New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

A newly disclosed vulnerability in the Linux Kernel Virtual Machine (KVM) could enable an attacker with elevated privileges within a Level 1 (L1) guest VM to break out of the virtual environment and execute arbitrary code on the underlying host system. The flaw, identified as CVE-2026-64561, stems from a stale-root check ordering issue in KVM's shadow memory management unit (MMU), potentially leading to a use-after-free condition.

Security researcher Hyunwoo Kim revealed a proof-of-concept demonstrating how this flaw can be leveraged to create a file on the host system. The vulnerability specifically impacts systems where nested virtualization is enabled and exposed to untrusted guests. A patch has been merged into the upstream Linux kernel and is recommended for all administrators using such configurations. Affected versions include multiple stable releases up to 7.2-rc5.