CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, guest escape to host root

HackSpeak distribution mirror. This repository is a distribution mirror of the complete PoC + technical write-up publicly released by researcher Hyunwoo Kim (@v4bel), with code and documentation identical to upstream.

⚠️ Upstream has no LICENSE attached: following distribution convention, this mirror uses the MIT License, Copyright (c) 2026 HackSpeak, while the source code copyright belongs to the original author, V4bel / @v4bel. The PoC has not been verified on real hardware; please test it first in a disposable environment (QEMU TCG), and do not use it against unauthorized targets.

Vulnerability Summary

Zapscape (CVE-2026-64561) is a Use-After-Free in the Linux KVM/x86 shadow MMU. An attacker with L1 guest kernel privileges (usually guest root) can escape to the host and execute code as root when nested virtualization is exposed to an untrusted guest.

• Root cause: an ordering issue in the stale-root check of the recursive zap path — after quota reclaim invalidates the current root, FNAME(fetch) still builds mappings under that root → an invalid child enters active_mmu_pages → the same list node gets linked into two lists → dangling link + post-free write;
• Exploit chain: post-free write → cross-cache twice (guest_memfd environment) → leak KASLR slide → craft a wait entry and hang it on log_wait → srcu_delay_timer callback → SRCU workqueue → call_usermodehelper → /bin/sh -c "umask 022; : > /Zapscape" → creates a root-owned /Zapscape on the host (uid 0 / mode 0644);
• Affected versions: from commit f95eec9bed76 (2020-07, Linux 5.9 onward) up to the fix commit 2abd5287f083 (2026-07-21); fixed in stable branches 6.6.148 / 6.12.101 / 6.18.42 / 7.1.6 / 7.2-rc5.

Environment & Usage

• Target: AMD nested SVM/NPT + Linux 7.1.3; it is recommended to test safely under QEMU TCG (QEMU v9.2.0+). Intel requires additionally exposing EPT page-walk lengths 4 and 5 to L1;
• Steps:
  1. Download the vulnerable v7.1.3 kernel source and build the kernel image according to kconfig;
  2. Compile the PoC: gcc -O2 -g -static -pthread poc.c -o poc, and build an initramfs with BusyBox or similar;
  3. Boot: ./qemu.sh bzImage initramfs.cpio.gz;
  4. Run ./poc inside the guest; on success, a root-owned /Zapscape file appears in the host root directory.
• Limitations: this PoC is not fully weaponized (in cloud environments, the L1 operations need to be rewritten into a guest kernel module and adapted to the host kconfig); when CONFIG_LIST_HARDENED is enabled, the post-free write is blocked, degrading to DoS/crash.

Related Vulnerabilities in the Same Series

• Januscape (CVE-2026-53359) and ITScape (CVE-2026-46316), both from V4bel's KVM escape series.

Disclaimer

• For security research, vulnerability verification, and authorized testing only; run it in a disposable environment (VM/container) and do not use it against unauthorized systems.
• This PoC is publicly released researcher code and has not been verified on real hardware; exploitation corrupts host kernel memory objects, and failure may crash the host.

References

• Upstream source repository (source of this PoC): https://github.com/V4bel/Zapscape
• Researcher's technical write-up: https://github.com/V4bel/Zapscape/blob/main/assets/write-up.md
• NVD: CVE-2026-64561 — https://nvd.nist.gov/vuln/detail/CVE-2026-64561
• Upstream fix commit: 2abd5287f083
• Vulnerability-introducing commit: f95eec9bed76