Zapscape Is the Latest Linux Vulnerability for KVM Guest-to-Host Escape
Zapscape is a six-year-old use-after-free in KVM’s x86 shadow-MMU emulation that lets a guest escape to the host and execute as root. On systems where /dev/kvm is world-writable, including some RHEL configurations, the same bug can act as a local privilege escalation without a guest.
The vulnerable code was fixed on 21 July by checking for an invalid or obsolete root after MMU pages become available. A public, non-weaponized proof of concept is available, so KVM operators should verify that their host kernels include the fix rather than relying only on guest isolation.