Information about vulnerability disclosed (CVE-2026-64561) in the KVM hypervisor, which allows root access to the host environment if root access is available in the guest system. The problem can also be used to locally escalate your privileges if you have access to the /dev/kvm device (for example, in RHEL such access is granted to all users). Exploit prototype is available for download. The problem is codenamed Zapscape.
The vulnerability is caused by memory access after freeing (use-after-free) in KVM hypervisor components executed on the virtual machine side to emulate a memory management unit (MMU) and address translation between the host and guest system. The vulnerability occurs on systems with Intel and AMD processors in the process of recursively deleting shadow memory pages, which occurs when MMU memory is freed (KVM recursively deletes the root shadow page, which continues to be used while the MMU is being cleared).
The problem is caused by an error accepted 6 years ago, and fixed a few days ago in kernel updates 7.1.6, 6.18.42 and 6