Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026080401-CVE-2026-64561-d0d4@gregkh/T
Additional exploitability information: A public PoC and full guest-to-host exploit demonstration for CVE-2026-64561 has been released: https://github.com/V4bel/Zapscape The repository includes poc.c, a kernel configuration, and a QEMU launch script. The demonstration reproduces the complete exploit chain under QEMU TCG and successfully creates the root-owned /Zapscape file on the KVM host. The researcher states that this is not yet a directly weaponized cloud exploit, but that porting it to a real KVM environment would mainly require moving the guest-side actions into a kernel module and adapting the exploit to the host kernel configuration. Could Red Hat please reassess the impact and severity in light of this public PoC, particularly the potential for guest-to-host root code execution and local privilege escalation on RHEL systems?