Vulnerability in Linux Kernel KVM Affects Memory Management
CVE-2026-64561

8.8HIGH

Key Information:

Vendor: Linux
Status: Linux
Vendor: CVE Published:; 4 August 2026

Badges

📈 Trended📈 Score: 6,480👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-64561?

CVE-2026-64561 is a vulnerability found in the Linux kernel's KVM (Kernel-based Virtual Machine) component, specifically regarding its memory management functionalities. This flaw affects how the kernel handles invalid or obsolete roots within its memory management unit (MMU) when working with shadow page tables. If the system attempts to reclaim shadow pages while marking an in-use root as invalid, it can result in the mapping of memory into this invalid state. Although the act of populating an invalid root does not pose an immediate threat by itself, it leads to a more significant issue whereby child shadow pages inherit improper attributes, violating KVM’s invariant that invalid pages cannot exist on the active MMU pages list. This vulnerability has roots dating back to 2008 but was exacerbated by changes introduced in 2020 that reinforced more stringent memory management policies.

Potential Impact of CVE-2026-64561

System Compromise Risk: Exploitation of this vulnerability could allow attackers to manipulate memory management in ways that lead to unauthorized access to sensitive information or control over affected virtual machines. This raises significant concerns for organizations utilizing KVM for their virtualized environments.
Instability in Virtualized Environments: Because of the potential for invalid memory pages to be created and inherited, systems could experience instability. Virtual machines might encounter crashes or unexpected behavior, disrupting services and leading to potential downtime.
Increased Attack Surface: The existence of this flaw broadens the attack surface for malicious actors. With the possibility of exploiting this vulnerability, attackers can potentially escalate privileges within the virtualized infrastructure, allowing for further attacks and spreading malware across connected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

This is an advertDeploy the Patch

Affected Version(s)

Linux f95eec9bed76d42194c23153cb1cc8f186bf91cb < 65c4f7a1028cf01a93a2762d679c289810ede990

Linux f95eec9bed76d42194c23153cb1cc8f186bf91cb < 35e77467610c4a37cb0ff54ee56b85f73b1f5700

Linux f95eec9bed76d42194c23153cb1cc8f186bf91cb < 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-64561
Created by HORKimhab

News Articles

It Security News

CVE-2026-64561

CVE-2026-64561 Zapscape Lets KVM Guests Escape to Linux Host With Root Privileges - IT Security News

2026-08-07 16:08 A Linux kernel vulnerability, tracked as CVE-2026-64561 and named Zapscape, could allow attackers to escape a KVM virtual machine and take control of its underlying Linux...

3 weeks ago