CVE-2026-64561: Linux KVM — Guest-to-Host Escape Risk (August 2026)

CVE-2026-64561 — Linux KVM

CVE-2026-64561 is a high-severity flaw in the Linux kernel’s KVM virtualization, allowing an attacker with kernel privileges inside an L1 guest VM to escape isolation and execute arbitrary code on the host. No active exploitation has been reported, but a public proof-of-concept exists and the impact is critical for multi-tenant environments.

Attack Vector

The vulnerability is rooted in KVM’s shadow memory management for nested virtualization. An attacker must first gain kernel-level privileges within an L1 guest VM. From there, exploiting the flaw enables code execution on the underlying Linux host, breaking the hypervisor boundary. The attack does not require physical access, but does require the attacker to control privileged code inside the guest. No specific IOCs have been published, but monitoring for unexpected KVM memory operations or privilege escalations from guest VMs is advised.

Who Is at Risk

Linux KVM hosts running vulnerable kernels are affected, including major distributions such as Debian and Red Hat. Any environment leveraging nested virtualization or running untrusted workloads in KVM guests is at heightened risk. Organizations with multi-tenant cloud infrastructure should prioritize assessment and patching.

Patch & Mitigate

• Patch: Apply the latest stable Linux kernel updates addressing CVE-2026-64561 as soon as possible. Monitor vendor advisories for distribution-specific patches.
• Workaround: If immediate patching is not possible, restrict nested virtualization and limit guest VM privileges. Avoid running untrusted code in KVM guests.
• Detect: Review host logs for anomalous KVM memory operations, unexpected privilege escalations, or abnormal guest-to-host process activity. Enable and monitor audit logging for KVM-related events.

MITRE ATT&CK

• TA0004 — Privilege Escalation: The attacker leverages a flaw to gain elevated privileges on the host from a guest VM.
• TA0001 — Initial Access: Requires initial compromise of a guest VM with kernel-level privileges before exploitation.

Source: https://thehackernews.com/2026/08/new-zapscape-kvm-flaw-could-let.html