Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

KVM/x86 shadow MMU stale-root check ordering flaw (CVE-2026-64561)

Vulnerability
First reported
Last updated
Happening score
H score 19
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-64561 discloses a Linux kernel weakness in KVM/x86 shadow MMU that can let a privileged L1 guest VM escape KVM isolation and execute code on the host. The flaw affects systems where nested virtualization is exposed to untrusted guests. A public proof-of-concept shows a path to host root execution, but the issue is not described as exploited in the wild. The upstream fix is merged, and unpatched hosts need a fixed stable kernel or vendor backport.

Related Happenings

Linux KVM shadow MMU use-after-free security flaw (CVE-2026-53359)

Vulnerability
H score34 First: 06.07.2026 20:37 Last: 06.07.2026 20:37 Sources 1

About this happening: CVE-2026-53359 is a Linux KVM shadow MMU use-after-free that a guest VM can trigger to corrupt host kernel shadow-page state, creating host panic and poten...

Open Happening

Linux kernel Dirty Frag local root escalation privilege-escalation flaw

Vulnerability
H score30 First: 08.05.2026 10:45 Last: 08.05.2026 10:45 Sources 1

About this happening: Dirty Frag is a newly disclosed Linux kernel zero-day that can give local attackers root privileges on most major Linux distributions. The flaw is anchored in the...

Open Happening

Timeline

  1. 06.08.2026 20:58 1 articles · 1h ago

    Security researcher reports Zapscape KVM escape flaw to kernel.org

    Initial Disclosure

    On July 11, 2026, Hyunwoo Kim reported the KVM/x86 shadow-MMU stale-root check ordering flaw to [email protected]. The bug can let an attacker with kernel privileges inside an L1 guest VM escape KVM isolation and execute code on the host when nested virtualization is exposed to untrusted guests.

    Show sources
    Open in new tab
  2. 06.08.2026 20:58 1 articles · 1h ago

    Upstream fix for the KVM shadow-MMU stale-root flaw is merged

    Mitigation Patch Update

    On July 21, 2026, the upstream patch for CVE-2026-64561 was posted and merged. The fix moves the stale-root check after make_mmu_pages_available(), so KVM restarts the fault with RET_PF_RETRY if reclaim invalidates the current root instead of continuing under the invalid root.

    Show sources
    Open in new tab
  5. 06.08.2026 20:58 2 articles · 1h ago

    Zapscape proof-of-concept shows a path to host root on vulnerable KVM systems

    Technical Analysis Update

    On August 6, 2026, Hyunwoo Kim's write-up made the Zapscape proof-of-concept public, showing a path that can create a root-owned file named /Zapscape on the host and that can run commands with kernel or root privileges. Kim said the flaw was not exploited in the wild and that real-world use would require adapting the exploit to the host kernel configuration and memory backend; the upstream fix was already merged, and administrators running KVM hosts that expose nested virtualization to untrusted guests were told to update to a fixed stable kernel or a vendor package with the patch backported.

    Show sources
    Open in new tab