New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts — Swati KhandelwalAug 06, 2026Virtualization Security / Linux [https://blogge
What’s new: A new vulnerability, tracked as CVE-2026-64561, has been discovered in the KVM (Kernel-based Virtual Machine) that could allow an attacker with kernel privileges inside an L1 guest virtual machine to escape KVM isolation and execute code on the host. The flaw affects the shadow memory management unit (MMU) used for nested virtualization and is particularly risky when untrusted guests are involved. The issue has been fixed in the upstream kernel.
Who’s affected
Administrators running KVM hosts that expose nested virtualization to untrusted guests are affected. The vulnerability impacts Linux kernel versions 5.9 and later until fixed stable releases, including 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Debian’s tracker lists several kernel packages as vulnerable.
What to do
- Update to a fixed stable kernel or a vendor package that backports the patch for CVE-2026-64561.
- Review your KVM configurations to ensure that nested virtualization is not exposed to untrusted guests.
- Monitor vendor advisories for updates on package statuses and additional guidance.
