KVM Escape, publication. CVE-2026-64561, ZAPScape

[proxnoci]

This is what i know so far:

https://cybernews.com/security/critical-kvm-zero-day-vulnerability-allows-vm-escape/
Which is underwhelming on content. No CVE yet, just a confirmation from vercel.

It would be third escape this year after ITScape (KVM/arm) and Januscape (KVM/x86)

What would be a good mitigation, any ideas to lock proxmox guests inside some selinux harness?

Update @22:13 the name now is zapscape.... CVE‑2026‑64561
https://github.com/V4bel/Zapscape

 

[proxnoci]

Added CVE & Link to the description

 

[leesteken]

This was fixed in the Linux kernel months ago: https://git.kernel.org/pub/scm/linu.../?id=0026dbb7de8ea76e97d6edf42fc3cc084564e2bf
I can't tell whether the fix was included in the Ubuntu kernel and then also Proxmox, but I would not be surprised if this was already resolved. Maybe you can try the example on an up to date PVE to be sure?

 

[proxnoci]

Debian kernels are fixed, Ubuntu kernels are not.

https://security-tracker.debian.org/tracker/CVE-2026-64561
https://ubuntu.com/security/CVE-2026-64561

 

[proxnoci]

There are quite some differences (>10000) between the kernel config of the POC (5511) and Proxmox(13338) , so verifying which ones exactly are relevant is some work.

 

[leesteken]

If you have the actual current sources of the Proxmox kernel then can you check the file arch/x86/kvm/mmu/mmu.c for the fix? EDIT: Or run the exploit to see if it succeeds.

 

[Neobin]

• https://git.proxmox.com/?p=pve-kernel.git;a=commitdiff;h=85b91acee2aef80d6c03af42b4782fceadd9b3b0
• https://git.proxmox.com/?p=pve-kern...;hpb=8307634d8d02fa22f0e6e532feeb993d66903dc5