Not sure if I'm late to that party on this one or not. Guest to host escape in Linux KVM.
> Zapscape (CVE-2026-64561)
> Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive zap path that runs when shadow pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds.
https://github.com/V4bel/Zapscape
Tom Sellers
npub1my…3fwr7
2026-08-07 00:45:01 UTC
Author Public Key
npub1myc2p4vlcsp6dxjaydll6jc4cqwk4axslafqlf6mnt9cm8qalt5sk3fwr7Seen on
wss://relay.momostr.pinkPublished at
2026-08-07 00:45:01 UTCEvent JSON
{
"id": "d74349b877fa8c3fb3bba8668a817340fe91905f0687dff96ecf32c7e1827bb7",
"pubkey": "d930a0d59fc403a69a5d237ffd4b15c01d6af4d0ff520fa75b9acb8d9c1dfae9",
"created_at": 1786063501,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@TomSellers/117051457629950989",
"web"
],
[
"proxy",
"https://infosec.exchange/users/TomSellers/statuses/117051457629950989",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/TomSellers/statuses/117051457629950989",
"pink.momostr"
],
[
"-"
]
],
"content": "Not sure if I'm late to that party on this one or not. Guest to host escape in Linux KVM.\n\n\u003e Zapscape (CVE-2026-64561)\n\u003e Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive zap path that runs when shadow pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds.\n\nhttps://github.com/V4bel/Zapscape",
"sig": "774e9cf8b746e6c999fd67c47ceb79518d03cd6f6fb9b099c7e38366cfe6e34059851d2e5bd417e44cf20f553c4f6b6eb31708f14afedebb4fed8ee8e24e67b5"
}