AIBRIEF
Hyunwoo Kim disclosed a memory safety bug in KVM's shadow page handling that only threatens AMD hosts that expose nested virtualization — guests that themselves run guests — to untrusted guests; the public proof of concept is demo grade, not
A public proof-of-concept on oss-security now shows a guest virtual machine escaping its KVM sandbox and running code on the Linux host kernel.
The bug, tracked as CVE-2026-64561 and dubbed "Zapscape" by discoverer Hyunwoo Kim (@v4bel), is a use-after-free in KVM/x86's shadow MMU recursive zap path. That code runs when the host reclaims shadow pages under memory pressure, and missing reference-counting lets a guest corrupt host page tables and escalate to arbitrary kernel code.
The PoC targets AMD SVM/NPT and was tested under QEMU TCG in a three-level nested chain: a Linux 7.1.3 + KVM_AMD host running an L1 guest that itself runs an L2 guest, with L1 switching from long mode to PAE to alias a shadow page as both child and pinned root. On success it drops a /Zapscape file owned by root on the L0 host.
Kim calls the public exploit demonstration code. Weaponizing it still requires porting the L1 logic into a guest kernel module and matching the host kernel config. The precondition is narrow: the attack only works where a KVM/x86 host exposes nested virtualization to untrusted guests, which describes multi-tenant public clouds selling nested-virt, not standalone KVM servers.
Operators running nested-virt on AMD can use live migration as first aid on plain VMs; a Hacker News thread on the disclosure discusses Kubernetes-style drain plus ksplice as an interim path. Linux 7.1.3 build and stable backport status were not in the disclosure bundle and need a separate check.