CVE-2026-64561: A root privilege on the guest could lead to root privilege on the host

A virtual machine does not always guarantee secure isolation. The CVE-2026-64561 vulnerability in the KVM hypervisor allows a user with root privileges in the guest system to gain access to the host environment with the same privileges.

This isn’t a “any random user on the internet takes over the server” scenario. The attacker must already have root access within the guest. But that is precisely why the problem is easy to underestimate: if the guest system is already compromised, KVM ceases to be the last reliable barrier.

There is an even more troubling scenario. If the attacker has access to the /dev/kvm device, the vulnerability can be exploited for local privilege escalation. The source specifically notes that in RHEL, such access is granted to all users—meaning that configuring permissions for this device becomes part of the security model, not just a technical detail.

The issue’s codename is Zapscape, and a prototype exploit is available for download. This is a practical warning for administrators: check who has been granted access to /dev/kvm, and do not assume that virtual machine isolation is sufficient protection once a guest system has been compromised.

Important caveats: the source does not specify which KVM versions are affected, whether a fix exists, or how easy it is to reproduce the attack. The vulnerability requires either root access on the guest system or access to /dev/kvm, so it cannot be described as a universal remote exploit. However, the availability of a prototype exploit increases the cost of inaction.

If root access has already been obtained on the guest system, do you consider such a virtual machine to be isolated from the host? Source: OpenNews.opennet.ru: General News Feed