CVE-2026-64561
HIGHKVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Title source: cnaExploitation Summary
EIP tracks 6 public exploits for CVE-2026-64561. PoCs published by HackSpeak, chuzhongyun, aarif450.
AI-analyzed exploit summary This repository contains a functional guest-to-host escape exploit for CVE-2026-64561, a use-after-free vulnerability in KVM/x86's shadow MMU. The exploit leverages recursive zapping of shadow pages without root_count guards to achieve privilege escalation on the host (creating /Zapscape as root).
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.
Exploits (6)
This repository contains a functional guest-to-host escape exploit for CVE-2026-64561, a use-after-free vulnerability in KVM/x86's shadow MMU. The exploit leverages recursive zapping of shadow pages without root_count guards to achieve privilege escalation on the host (creating /Zapscape as root).
This repository provides a detailed technical guide for upgrading the Linux Kernel to version 7.1.6/7.1.7 to mitigate CVE-2026-64561, a vulnerability in the KVM/x86 subsystem. The writeup includes step-by-step instructions for ELRepo RPM installation and source-code compilation, with environment-specific considerations for KVM hosts.
The repository contains only a README.md file describing an educational website with no relation to CVE-2026-64561 or any exploit code. No technical details, vulnerability analysis, or proof-of-concept are present.
This repository contains a functional guest-to-host escape exploit for CVE-2026-64561, a use-after-free vulnerability in KVM/x86's shadow MMU. The exploit leverages a recursive zap flaw in `mmu_page_zap_pte()` to achieve host privilege escalation (creating `/Zapscape` as root) via nested virtualization (AMD SVM/NPT).
This repository provides a detailed technical analysis and patch backports for CVE-2026-64561 (Zapscape), a use-after-free vulnerability in the KVM/x86 shadow MMU. The patches correct the ordering of stale root checks in KVM page fault handlers to prevent invalid shadow page list insertions and post-free writes, which could lead to guest-to-host escapes.
This repository contains a functional guest-to-host escape exploit for CVE-2026-64561, a use-after-free vulnerability in KVM/x86's shadow MMU. The exploit leverages a recursive zap flaw in `mmu_page_zap_pte()` to achieve privilege escalation from an unprivileged guest to host root via nested virtualization (AMD SVM/NPT).
References (5)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H