Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-64561 — Zapscape (CVE-2026-64561) KVM/x86 shadow MMU UAF guest-to-host escape PoC mirror — V4bel/@v4bel, MIT; for authorized security testing | Kitploit
Tools/GitHubGitHub/hackspeak/cve-2026-64561
Vulnerability AnalysisExploitationSecurity VirtualizationRed TeamingBinary Exploitation
GitHubhackspeak/cve-2026-64561

CVE-2026-64561

Zapscape (CVE-2026-64561) KVM/x86 shadow MMU UAF guest-to-host escape PoC mirror — V4bel/@v4bel, MIT; for authorized security testing

View Repository
1101 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, guest escape to host root

HackSpeak distribution mirror. This repository is a distribution mirror of the complete PoC + technical write-up publicly released by researcher Hyunwoo Kim (@v4bel), with code and documentation identical to upstream.

⚠️ Upstream has no LICENSE attached: following distribution convention, this mirror uses the MIT License, Copyright (c) 2026 HackSpeak, while the source code copyright belongs to the original author, V4bel / @v4bel. The PoC has not been verified on real hardware; please test it first in a disposable environment (QEMU TCG), and do not use it against unauthorized targets.

Vulnerability Summary

Zapscape (CVE-2026-64561) is a Use-After-Free in the Linux KVM/x86 shadow MMU. An attacker with L1 guest kernel privileges (usually guest root) can escape to the host and execute code as root when nested virtualization is exposed to an untrusted guest.

  • Root cause: an ordering issue in the stale-root check of the recursive zap path — after quota reclaim invalidates the current root, FNAME(fetch) still builds mappings under that root → an invalid child enters active_mmu_pages → the same list node gets linked into two lists → dangling link + post-free write;
  • Exploit chain: post-free write → cross-cache twice (guest_memfd environment) → leak KASLR slide → craft a wait entry and hang it on → callback → SRCU workqueue → → → creates a root-owned on the host (uid 0 / mode 0644);
log_wait
srcu_delay_timer
call_usermodehelper
/bin/sh -c "umask 022; : > /Zapscape"
/Zapscape
  • Affected versions: from commit f95eec9bed76 (2020-07, Linux 5.9 onward) up to the fix commit 2abd5287f083 (2026-07-21); fixed in stable branches 6.6.148 / 6.12.101 / 6.18.42 / 7.1.6 / 7.2-rc5.

    • Environment & Usage

    • Target: AMD nested SVM/NPT + Linux 7.1.3; it is recommended to test safely under QEMU TCG (QEMU v9.2.0+). Intel requires additionally exposing EPT page-walk lengths 4 and 5 to L1;
    • Steps:
      1. Download the vulnerable v7.1.3 kernel source and build the kernel image according to kconfig;
      2. Compile the PoC: gcc -O2 -g -static -pthread poc.c -o poc, and build an initramfs with BusyBox or similar;
      3. Boot: ./qemu.sh bzImage initramfs.cpio.gz;
      4. Run ./poc inside the guest; on success, a root-owned /Zapscape file appears in the host root directory.
    • Limitations: this PoC is not fully weaponized (in cloud environments, the L1 operations need to be rewritten into a guest kernel module and adapted to the host kconfig); when CONFIG_LIST_HARDENED is enabled, the post-free write is blocked, degrading to DoS/crash.

    Related Vulnerabilities in the Same Series

    • Januscape (CVE-2026-53359) and ITScape (CVE-2026-46316), both from V4bel's KVM escape series.

    Disclaimer

    • For security research, vulnerability verification, and authorized testing only; run it in a disposable environment (VM/container) and do not use it against unauthorized systems.
    • This PoC is publicly released researcher code and has not been verified on real hardware; exploitation corrupts host kernel memory objects, and failure may crash the host.

    References

    • Upstream source repository (source of this PoC): https://github.com/V4bel/Zapscape
    • Researcher's technical write-up: https://github.com/V4bel/Zapscape/blob/main/assets/write-up.md
    • NVD: CVE-2026-64561 — https://nvd.nist.gov/vuln/detail/CVE-2026-64561
    • Upstream fix commit: 2abd5287f083
    • Vulnerability-introducing commit: f95eec9bed76
    Download Tool