## https://sploitus.com/exploit?id=DE767A3D-B8C6-5A02-A0EC-4D190326C5C5
# CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, allowing attackers to escape to the host’s root access
>HackSpeak distributes this image. **Original repository (upstream): github.com/V4bel/Zapscape** – Researchers Hyunwoo Kim (@v4bel) have published a complete PoC along with technical documentation. This repository serves as an image for “backend replies.” **The code and documentation are consistent with the upstream version.**
> ⚠️ **The upstream repository does not include a license notice:** The image is distributed under **MIT License, Copyright © 2026 HackSpeak**. The source code belongs to the original author, V4bel (@v4bel). **The PoC has not been tested on real machines.** Please test it in a destructible environment (QEMU TCG) before using it on unauthorized targets. ## Description of the vulnerability
**Zapscape (CVE-2026-64561)** is a Use-After-Free vulnerability in the Linux KVM/x86 **shadow MMU**. Attackers with kernel privileges at the L1 level (usually guest root) can escape to the host’s root access and execute code as root.
- **Root cause:** A problem with the **stale-root check order** in recursive zap paths. After quota reclamation invalidates the current root, `FNAME(fetch)` still creates mappings under that root. Invalid child processes enter `active_mmu_pages`, leading to double-linked lists being attached to two lists. This results in a dangling link, followed by **post-free write** operations.
- **Exploitation chain:** Post-free write → Two cross-cache operations (in the guest_memfd environment) → Leakage of KASLR slides → Creation of a wait entry that gets attached to `log_wait` → `srcu_delay_timer` callback → SRCU workqueue → `call_usermodehelper` → `/bin/sh -c "umask 022; /Zapscape"` → Create all `/Zapscape` files with root permissions on the host.
- **Affected versions:** Commit `f95eec9bed76` (2020-07, Linux 5.9 onwards) to commit `2abd5287f083` (2026-07-21). Stable branches 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 have been fixed. ## Environment and usage
- **Target:** AMD nested SVM/NPT + **Linux 7.1.3**. It’s recommended to test in **QEMU TCG** (QEMU v9.2.0+). For Intel systems, additional exposure to EPT page-walk lengths 4 and 5 is required.
- **Steps:**
1. Download the vulnerable v7.1.3 kernel source code and build the kernel image using `kconfig`.
2. Compile the PoC: `gcc -O2 -g -static -pthread poc.c -o poc`, and create an initramfs using BusyBox.
3. Run the PoC:`./qemu.sh bzImage initramfs.cpio.gz`.
4. Run `./poc` inside the guest. After successful execution, all `/Zapscape` files will be created in the host root directory.
- **Limitations:** This PoC is not fully weaponized. In cloud environments, the L1 actions need to be transformed into guest kernel modules and adapted to the host kconfig settings. If `CONFIG_LIST_HARDENED` is enabled, post-free write operations will be blocked, potentially causing system crashes. ## Related vulnerabilities
- Januscape (CVE-2026-53359), ITScape (CVE-2026-46316) – Both are KVM escape vulnerabilities developed by V4bel. ## Disclaimer
- This tool is intended only for security research, vulnerability testing, and authorized tests. Please run it in a destructible environment (virtual machine/container). Do not use it on unauthorized systems. This PoC contains unverified code from researchers. Exploitation may damage the host’s kernel memory objects, potentially causing crashes. ## References
- **Upstream repository (source of this PoC):** https://github.com/V4bel/Zapscape
- Researchers’ technical documentation: https://github.com/V4bel/Zapscape/blob/main/assets/write-up.md
- NVD: CVE-2026-64561 – https://nvd.nist.gov/vuln/detail/CVE-2026-64561
- Upstream fix: `2abd5287f083`
- Vulnerability introduction: `f95eec9bed76`