Zapscape KVM flaw allows L1 guest escape to host with nested virtualization

Affected Systems

Linux kernel KVM/x86 shadow MMU in versions 5.9 through 7.1.5. Fixed in stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Affects systems running KVM hosts with nested virtualization exposed to untrusted guests. Intel systems require EPT page-walk length 4 and 5 exposed to L1 guest; AMD has no equivalent condition.

Exploitation Status

Public proof-of-concept available targeting AMD nested SVM/NPT on Linux 7.1.3. No evidence of in-the-wild exploitation. Researcher notes PoC is not weaponized for immediate cloud use and would require adaptation to specific host kernel configurations and memory backends.

Business Impact

High-severity VM escape vulnerability (CVSS 7.0) affecting KVM hypervisors with nested virtualization enabled. Attacker requires kernel/root privileges inside L1 guest VM to exploit. Use-after-free in shadow MMU allows code execution on host with root privileges. Primary risk to cloud providers and environments offering nested virtualization to untrusted tenants. Standard single-layer virtualization without nested VMs is not affected.

Urgency

🟠 Within 24 hours

Recommended Actions

• Update KVM hosts exposing nested virtualization to fixed kernel versions: 6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5 or later, or apply vendor-backported patches
• Verify patch status using distribution-specific security trackers (Red Hat, Debian, Ubuntu) rather than relying solely on kernel version numbers
• If immediate patching is not feasible, disable nested virtualization on KVM hosts serving untrusted guests until patches are applied
• Review and restrict which guest VMs have nested virtualization capabilities enabled, limiting exposure to trusted workloads only
• Monitor for unusual L1 guest kernel module loading or privilege escalation attempts that could indicate exploitation preparation