Zapscape Flaw in KVM Breaks Nested Virtualization Isolation Allowing L1 Guest Root Code Execution on Linux Host

A security flaw in KVM/x86 within the Linux kernel has highlighted a risk that many infrastructure platforms accept almost without question: nested virtualization exposed to untrusted workloads. The vulnerability, named Zapscape and registered as CVE-2026-64561, can allow an attacker with kernel privileges inside a level-1 virtual machine to execute code on the host with root permissions.

The problem centers on the shadow MMU and the way KVM manages shadow page tables when the L1 guest itself acts as a hypervisor for an L2 guest. In practical terms, the isolation that normally protects the host from activity inside a VM is weakened exactly in the scenario where a provider grants more power to a tenant by allowing nested virtualization inside the tenant’s own VM.

The technical root cause lies in an incorrect ordering when checking a “stale root” condition during guest page-fault handling. This sequence can result in a use-after-free, followed by writes after free — a classic pattern used to turn a memory corruption issue into arbitrary code execution.

Public disclosure includes a proof-of-concept exploit that chains the vulnerability and ultimately creates a file named /Zapscape on the host with root ownership. On Intel platforms the scenario requires the L1 guest to have EPT page walk lengths 4 and 5 exposed. No equivalent condition appears in the published information for AMD processors.

No active exploitation in real-world attacks has been observed so far. Nevertheless, the potential scope justifies rapid action, especially in multi-tenant environments. The NVD lists affected versions starting from Linux 5.9, and fixes are already present in the mainline tree and stable branches, including versions 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2 rc5.

The most direct mitigation is to update to a patched stable kernel or install the vendor package containing the backported fix. At the same time, organizations should inventory hosts that offer nested virtualization to untrusted tenants and treat them as patching priorities. If a server does not require nested virtualization, disabling it immediately reduces the attack surface. Administrators should also verify the effective version through their distribution vendor, because some fixes arrive as backports without obvious changes to the upstream version string.