Zapscape (CVE-2026-64561): KVM guest escape — TuxCare livepatch status and fixed kernels

Issue

A critical Linux kernel vulnerability known as Zapscape (CVE-2026-64561) was published on 06/08/26, together with a public proof of concept. It is a KVM guest-to-host escape: an attacker with root inside a KVM guest can gain root on the hypervisor host.

Customers running KernelCare Enterprise may have these questions:

• Is my system affected?
• Is a KernelCare live patch available, and what is the ETA?
• What can I do in the meantime?

A server does not have to be a dedicated hypervisor to be exposed. On any host where /dev/kvm is readable and writable by local users, an unprivileged user can start a guest of their own, become root inside it, and attack the host kernel from there.

Environment

• TuxCare
• KernelCare Enterprise 
• CloudLinux OS 7 Hybrid, 8, 9 and 10 
• CloudLinux OS 8 LTS and 9 LTS (TuxCare Endless Lifecycle Support kernels) 
• AlmaLinux, Red Hat Enterprise Linux and derivatives, versions 8, 9 and 10 Ubuntu 22.04 (Jammy) and Ubuntu 24.04 (Noble) 
• Kernel with KVM loaded, or /dev/kvm reachable by local users

Solution

Per-platform release status is tracked on the status page incident linked below. It is updated as each fixed kernel and each live patch ships — check it rather than this article for current availability.

1. Establish what the server runs

cat /etc/redhat-release   # lsb_release -d on Ubuntu
uname -r

CloudLinux OS 7 (kernel 3.10) is not affected — the kernel predates the vulnerable code. Everything from kernel 5.9 onward, and the 4.18 EL8 line, contains it.

2. Update to a fixed kernel

These fixed kernels are released and available now:

dnf update 'kernel*'
reboot

On CloudLinux OS 8 and 7 Hybrid, while the rebuild is still in beta, add --enablerepo=cloudlinux-updates-testing (CloudLinux OS 8) or --enablerepo=cl7h_beta (7 Hybrid) to a yum update 'kernel*'.

Two caveats worth checking before you update:

• CloudLinux OS rebuilds on top of the AlmaLinux base, so 553.147.1 is not a fixed version on a CloudLinux kernel. The first fixed CloudLinux build is 553.150.1.lve.
• Extended Update Support streams (8.6, 8.8, 9.4, 9.6) do not carry the fix.

For CloudLinux OS 10, the LTS streams and Ubuntu, a fixed kernel is not yet published. Apply the mitigations below in the meantime.

3. Mitigate without a reboot

Any one of these removes the attack surface immediately:

1. Place all untrusted users in CageFS — a caged user cannot reach /dev/kvm:

   cagefsctl --enable-all
   cagefsctl --list-disabled

2. If KVM is unused, unload it and blacklist the modules under /etc/modprobe.d/:

   modprobe -r kvm_intel kvm

Use kvm_amd on AMD hardware. 3. If KVM is used, restrict the device node with chmod 0600 /dev/kvm, persisted by a udev rule: KERNEL=="kvm", MODE="0600". 4. If the server hosts virtual machines for untrusted tenants, migrate those guests to a patched host.

4. KernelCare live patches

Live patches are in preparation for the affected EL8, EL9, EL10, Ubuntu 22.04 and Ubuntu 24.04 kernels. Release state is on the status page; subscribing to the incident is the quickest way to be notified.

Once a patch is released, update the agent and confirm coverage:

kcarectl --update
kcarectl --patch-info | grep -i 2026-64561

If kcarectl --patch-info reports no patch information file, read the applied patch's CVE list directly:

grep CVE-2026-64561 /proc/kcare/cvelist

Live patches roll out in stages, so part of a fleet may show no coverage for several hours after release. This is expected.

Cause

The vulnerability is a race in the KVM x86 memory management unit. The kernel checked for an invalid or obsolete root before making MMU pages available instead of after, so if reclaiming shadow pages zapped an in-use root, KVM would map memory into an invalid root. Child shadow pages inherit their parent's role, so they were created as invalid pages and placed on the list of active MMU pages, breaking the invariant that invalid pages are never active.

The underlying flaw dates back to 2008, but it became exploitable in Linux 5.9 (2020), when the invariant on invalid shadow pages was introduced. The upstream fix is commit 2abd5287f083, merged on 13/07/26.

Useful Links

• CVE-2026-64561: https://nvd.nist.gov/vuln/detail/CVE-2026-64561 
• Zapscape proof of concept and researcher write-up: https://github.com/V4bel/Zapscape
• Public disclosure on oss-security:  https://seclists.org/oss-sec/2026/q3/460 
• Upstream fix commit 2abd5287f083: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083 
• CloudLinux status page incident: https://cloudlinux.statuspage.io/incidents/dlrxjx23zz5f 
• CloudLinux blog advisory: https://blog.cloudlinux.com/zapscape-cve-2026-64561-kvm-guest-escape-and-local-root-mitigation-and-kernel-update-for-cloudlinux/