KVM x86 Guest-to-Host Escape via UAF in Shadow MMU (CVE-2026-64561) Analysis and PoC

Vulnerability Overview Zapscape (CVE-2026-64561) is a guest-to-host escape vulnerability found in the KVM/x86 environment. This vulnerability allows an attacker to escape from a virtual machine to the host machine within a KVM/x86 environment and execute commands with root privileges. Zapscape is a use-after-free (UAF) vulnerability that specifically occurs in the shadow MMU emulation of KVM/x86, particularly within the recursive zap path when shadow pages are reclaimed. An attacker can trigger this vulnerability through guest-side actions, corrupting the host kernel's shadow pages, thereby compromising the guest-host isolation of the KVM/x86 host and exposing nested virtualization, especially in multi-tenant x86 public clouds. Impact Scope Affected Versions: Zapscape (CVE-2026-64561) affects versions ranging from (2020-07-08) to (2026-07-21). Impact: - KVM Escape: An attacker can gain control over the host machine running their VM. For example, the attacker can cause the host to crash, affecting other tenants' VMs, or execute code with privileged status. - LPE (Local Privilege Escalation): In some distributions (such as RHEL), is world-writable, allowing unprivileged users to exploit this vulnerability to obtain root privileges. Remediation Fix Recommendation: It is recommended to establish a sustainable patching process to address host hypervisor vulnerabilities. PoC Structure: The Proof of Concept (PoC) is written for AMD. It is recommended to run it under QEMU TCG to ensure safety. The structure of the PoC is as follows: - L0: Linux 7.1.3 + KVM_AMD is simulated on an x86_64 CPU (AMD SVM/NPT). The escape target L1: guest poc is created. Switch long -> PAE aliases a shadow page as a sub-page, and L2: guest L1 VMRun. Its memory access triggers L0 quota reclamation -> recursive zap. PoC Usage: 1. Download the vulnerable v7.1.3 kernel source code, then build the kernel image based on the bundled kconfig. 2. Build the PoC, then use BusyBox or similar tools to combine a suitable initramfs, and place the built PoC into the initramfs. 3. Start the Linux 7.1.3 target using the following command. Tested on QEMU v9.2.0 or higher. 4. After QEMU TCG starts, run the PoC. Upon successful exploitation, it will escape the guest and create a file owned by root. PoC Code ```bash gcc -O2 -g -static -pthread poc.c -o poc ./qemu.sh bzImage initramfs.cpio.gz /$$$$$$$/$$$$$$/$$$$$$ /$$/ /$$/ /$$/ /$$/ /$$$$$$$$$$

Goal Reached Thanks to every supporter — we hit 100%!

KVM x86 Guest-to-Host Escape via UAF in Shadow MMU (CVE-2026-64561) Analysis and PoC

More from this source