New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts
Summary
A new Linux kernel vulnerability called Zapscape (CVE-2026-64561) allows an attacker with kernel privileges in an L1 guest virtual machine to escape KVM isolation and execute code on the host. This risk is present when nested virtualization is exposed to untrusted guests.
IFF Assessment
This vulnerability allows an attacker to gain unauthorized code execution on the host system, posing a significant threat to defenders.
Severity
This vulnerability allows for local privilege escalation and code execution on the host system. The attack requires kernel privileges within a guest but has a high impact on confidentiality, integrity, and availability.
Defender Context
Defenders should be aware of this KVM vulnerability, particularly in environments utilizing nested virtualization with untrusted guests. Prompt patching and strict access controls for guest VMs are crucial to mitigate the risk of code escape and host compromise.