Researcher publishes exploit for KVM guest-to-host escape

Security researcher Hyunwoo Kim published a working exploit for a KVM guest-to-host escape on August 6, after an oss-security embargo lifted.

The bug, tracked as CVE-2026-64561, lets code running inside an affected guest reach root on the host machine. It also works as local privilege escalation wherever /dev/kvm is left world-writable. That's the condition behind plenty of KVM-backed sandboxes and multi-tenant CI runners built to run untrusted or agent-generated code.

Kim published the proof-of-concept as Zapscape on GitHub. The flaw is a use-after-free in KVM/x86's recursive zap path during shadow page table reclamation. It's triggerable entirely from guest-side actions.

His writeup traces the affected window to two commits: f95eec9bed76, merged July 8, 2020, and the fix at 2abd5287f083, landed July 21, 2026. Just over six years of shipped kernels carried the bug.

The real risk isn't cloud hypervisors. It's the self-hosted KVM sandboxes running agent and CI workloads. Nobody's tracking six years of kernel drift there, or auditing /dev/kvm permissions, until a working exploit shows up on GitHub.

The exploit went public the same day the oss-security embargo on it lifted, August 6.