GitHub - V4bel/Zapscape · GitHub
/" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
V4bel
Zapscape
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>1 Commit<br>1 Commit
assets
assets
README.md
README.md
kconfig
kconfig
poc.c
poc.c
qemu.sh
qemu.sh
View all files
Repository files navigation
The KVM Escape Trilogy
ITScape
(CVE-2026-46316)
Januscape
(CVE-2026-53359)
Zapscape
(CVE-2026-64561)
Zapscape: Guest-to-Host Escape in KVM/x86
Abstract
This document describes the Zapscape (CVE-2026-64561) vulnerability discovered and reported by Hyunwoo Kim (@v4bel). It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment and run commands on the host with kernel (root) privilege.
Zapscape is a use-after-free vulnerability in the shadow MMU emulation of KVM/x86, specifically in the recursive zap path that runs when shadow pages are reclaimed. It can trigger the bug with guest-side actions alone to corrupt the host kernel's shadow page, and it can threaten the guest-host isolation of KVM/x86 hosts that accept untrusted guests and expose nested virtualization, particularly multi-tenant x86 public clouds.
For the detailed technical information, see here.
Note<br>After reporting this vulnerability to linux-distros@vs.openwall.org, the agreed embargo has ended, so the exploit is posted to oss-security and this Zapscape document is published. For the disclosure timeline, see the technical detail document.
PoC Structure
The PoC is written to target AMD, and for safe testing, running it under QEMU TCG is recommended. The PoC has the following structure.
PAE aliases one shadow page as both child and pinned root, and L1 then escalates the UAF into L0 kernel code-exec<br>└─ L2: the guest L1 VMRUNs. Its memory touches trigger L0's quota reclaim -> recursive zap with no root_count guard -> UAF">L0: Linux 7.1.3 + KVM_AMD on an x86_64 CPU (AMD SVM/NPT) emulated by QEMU TCG. The escape target<br>└─ L1: the guest poc creates. Switching long -> PAE aliases one shadow page as both child and pinned root, and L1 then escalates the UAF into L0 kernel code-exec<br>└─ L2: the guest L1 VMRUNs. Its memory touches trigger L0's quota reclaim -> recursive zap with no root_count guard -> UAF
This PoC is not a weaponized exploit that runs immediately in a cloud environment, but demonstration code that reproduces the vulnerability and the full exploit chain on top of QEMU TCG. To use it in a real cloud environment, the L1 actions the PoC performs must be moved into a guest kernel module, and the exploit must be ported to match the host kernel's kconfig. This is not a difficult task.
PoC Usage
Download the vulnerable v7.1.3 kernel source, then build the kernel image based on the bundled kconfig.
Build the PoC, then compose a suitable initramfs using BusyBox or the like and put the built PoC into the initramfs.
# gcc -O2 -g -static -pthread poc.c -o poc
Boot the Linux 7.1.3 target with the following command. Test on QEMU v9.2.0 or later.
# ./qemu.sh bzImage initramfs.cpio.gz
After QEMU TCG boots, run the PoC. On a successful exploit, it escapes the guest and creates the /Zapscape file owned by root on the host.
/$$$$$$$$ /$$$$$$ /$$$$$$$<br>|_____ $$ /$$__ $$| $$__ $$<br>/$$/ | $$ \ $$| $$ \ $$<br>/$$/ | $$$$$$$$| $$$$$$$/<br>/$$/ | $$__ $$| $$____/<br>/$$/ | $$ | $$| $$<br>/$$$$$$$$| $$ | $$| $$<br>|________/|__/ |__/|__/
[+] /Zapscape created by the target KVM host kernel (owner uid=0, mode=0644).<br>[+] exploit completed - verify with: ls -la /Zapscape<br>zapscape(uid=65534)$ ls -la /Zapscape<br>-rw-r--r-- 1 root root 0 Jul 29 05:27 /Zapscape<br>zapscape(uid=65534)$
This PoC is intended to provide accurate information. Do not use it on systems you are not authorized to test.
Affected Versions
Zapscape (CVE-2026-64561) covers the range from f95eec9bed76 (2020-07-08) to 2abd5287f083 (2026-07-21).
FAQ
What is the impact of this vulnerability?
The same as Januscape (CVE-2026-53359):
KVM escape : With guest-side actions alone, an attacker can compromise the host that runs their VM. For example, an attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine (DoS), or run code with root privilege on the host to take over the host and all the guests on it (RCE).
LPE : On distributions such as RHEL, /dev/kvm is world-writable (0666), so an unprivileged user can also use this vulnerability as an LPE to gain root. When it is used as an...