Hyunwoo Kim (@v4bel) discovered Zapscape (CVE-2026-64561), a guest-to-host escape in KVM/x86. The write-up walks through a use-after-free in KVM’s shadow MMU: nested virtualization produces an invalid child page that inherits an invalid role from its parent, and a cross-cache technique rebuilds the freed object inside guest-accessible memory. From there a chain of list manipulations and kernel pointer leaks yields an arbitrary kernel write and, ultimately, code execution with kernel privilege: a guest quietly creating root-owned files on the host.
