Zapscape Breaks the Linux KVM Boundary. A Server Without a Single VM Can Still Be in Range.

The economics of VPS and cloud hosting rest on a single promise: many customers can share one physical machine because the hypervisor keeps each of them sealed inside their own virtual machine. Zapscape breaks that seal. Disclosed on August 6, 2026 and tracked as CVE-2026-64561, it is a use-after-free flaw in the KVM hypervisor built into the Linux kernel. An attacker who already holds root inside…

Source