Zapscape KVM escape exploit - CVE-2026-64561

AnthonySmith

Ah crap here we go again, I need to do some reading but might be another round of reboots.

https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html?m=1

MikeA

Like the others this is only for servers running nested virtualization. I ran nested virtualization forever, but after so many vulnerabilities that stem from it, I decided to just disable it on all of my systems. For people that need nested virtualization, they can emulate it via software (I believe qemu has virt emulation built in.) The main issue will probably be with people using Windows servers who want to run WSL2, I'm not familiar enough with Windows/HyperV virtualization to know if it supports any emulation.

No need to reboot if you want to disable it. Just issue virsh command to shut down all VMs running on the system, unload the kvm kernel module, then enable the kvm module with nested set to 0 and boot the VMs back up.

yoursunny

@MikeA said:
I ran nested virtualization forever, but after so many vulnerabilities that stem from it, I decided to just disable it on all of my systems.

Refund requests incoming if the customer bought specifically for nested virtualization.

For people that need nested virtualization, they can emulate it via software (I believe qemu has virt emulation built in.)

Yes, it's called tcg and existed well before KVM existed.
The main use case was to run a virtual machine on a processor that doesn't have virtualization at all.

AnthonySmith

Software emulation is a last resort usually because it basically eats CPU time.

Just my opinion.

Obviously if having nesting available becomes an ongoing security concern, then it's probably not going to be worth supporting.

But .. still reading and testing

SpeedBus

Yet another one which is directly related to nested virtualization being enabled/available .. welp.

What's somewhat interesting about this one is (IF I understand this correctly) compared to Januscape, looking at the CloudLinux/KernelCare page for this[1], this line caught my eye,

Whether a given server is exposed depends on two further conditions: both paths need nested virtualization enabled, and either an AMD processor or an Intel one from Ice Lake-SP onward.

...... Intel hosts are only reachable where the host exposes both four-level and five-level Extended Page Tables (EPT) to guests, which means Ice Lake-SP and newer.

IIRC/AFAIK: Most providers I've seen on here using Intel CPUs either are on Intel Gold 1st/2nd Gen or E5s, these are much older than the the 3rd Gen Intel which seems to be Ice Lake-SP onward. So (maybe/at-your-own-risk) older Intel CPUs might not be affected.

but well, I wouldn't really bank on it, looking at everything going on every other day (cPanel.. VMWare..), a reboot seems to be the least painful option and if someone's on stock kernels KernelCare seems to be (even more) worth it now at $2.5/mo/node.

For AlmaLinux/Rocky Linux users, ELRepo already has the kernel 7.1.7 available which has the fixes in it AFAIK, they were included in 7.1.6.

[1] https://blog.cloudlinux.com/zapscape-cve-2026-64561-kvm-guest-escape-and-local-root-mitigation-and-kernel-update-for-cloudlinux/