8.8
HIGH
CVSS 3.1
CVE-2026-64561
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.
Details
INFO
Published Date :
Aug. 4, 2026, 7:16 a.m.
Last Modified :
Aug. 27, 2026, 1:18 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Update the Linux kernel to address an MMU page mapping issue that could violate invariants.
- Update the Linux kernel to the latest stable version.
- Apply the specific patch for the KVM MMU issue.
- Rebuild and deploy the updated kernel.
- Verify system stability and security.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64561.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64561 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64561
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64561 vulnerability anywhere in the article.
-
The Hacker News
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts
Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applie ... Read more
Published Date:
Aug 06, 2026 (3 weeks, 4 days ago)
The following table lists the changes that have been made to the
CVE-2026-64561 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 27, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/64xxx/CVE-2026-64561.json">CVE-2026-64561</a> Added Reference https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf Added Reference https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db Added Reference https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700 Added Reference https://git.kernel.org/stable/c/62ef67af1878fa2cd066642f2f59e33ade95f637 Added Reference https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990 Added Reference https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d Added Reference https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5 Added Reference https://github.com/V4bel/Zapscape Removed Reference https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf Removed Reference https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db Removed Reference https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700 Removed Reference https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990 Removed Reference https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d Removed Reference https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5 Removed Reference https://github.com/V4bel/Zapscape -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 19, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '35e77467610c4a37cb0ff54ee56b85f73b1f5700', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '0026dbb7de8ea76e97d6edf42fc3cc084564e2bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'f3477a6a4164f15287444eda685b5f6405dbd1e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'bce0d3c26e2c761a4bf43c8949f333fc7374eb2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '2abd5287f08319fa35764566b15c6e22cb1068db', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '65c4f7a1028cf01a93a2762d679c289810ede990', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '35e77467610c4a37cb0ff54ee56b85f73b1f5700', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '0026dbb7de8ea76e97d6edf42fc3cc084564e2bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'f3477a6a4164f15287444eda685b5f6405dbd1e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'bce0d3c26e2c761a4bf43c8949f333fc7374eb2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '2abd5287f08319fa35764566b15c6e22cb1068db', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '35e77467610c4a37cb0ff54ee56b85f73b1f5700', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '0026dbb7de8ea76e97d6edf42fc3cc084564e2bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'f3477a6a4164f15287444eda685b5f6405dbd1e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'bce0d3c26e2c761a4bf43c8949f333fc7374eb2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '2abd5287f08319fa35764566b15c6e22cb1068db', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '35e77467610c4a37cb0ff54ee56b85f73b1f5700', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '0026dbb7de8ea76e97d6edf42fc3cc084564e2bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'f3477a6a4164f15287444eda685b5f6405dbd1e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'bce0d3c26e2c761a4bf43c8949f333fc7374eb2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '2abd5287f08319fa35764566b15c6e22cb1068db', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 09, 2026
Action Type Old Value New Value Added Reference https://github.com/V4bel/Zapscape -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 04, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '35e77467610c4a37cb0ff54ee56b85f73b1f5700', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '0026dbb7de8ea76e97d6edf42fc3cc084564e2bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'f3477a6a4164f15287444eda685b5f6405dbd1e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': 'bce0d3c26e2c761a4bf43c8949f333fc7374eb2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f95eec9bed76d42194c23153cb1cc8f186bf91cb', 'lessThan': '2abd5287f08319fa35764566b15c6e22cb1068db', 'versionType': 'git'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/kvm/mmu/mmu.c', 'arch/x86/kvm/mmu/paging_tmpl.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately. Added Reference https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf Added Reference https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db Added Reference https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700 Added Reference https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d Added Reference https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.