Zapscape (CVE-2026-64561) KVM guest escape and local root

Incident Report for CloudLinux

Update

KernelCare Updates:

The following patchsets are available for ePortal -
- rhel10 (K20260812_0007)
- oel10 (K20260812_0008)
- rockylinux10 (K20260812_0009)
- almalinux10 (K20260812_0010)

Subscribed servers on those versions receive the patch automatically on the next update cycle, or immediately with kcarectl --update.

To check if you're patched, check build time with kcarectl --info | grep kpatch-build-time.

rhel10 -> build dated 2026-08-14 or later

oel10, rockylinux10, almalinux10 -> build dated 2026-08-17 or later
Posted Aug 19, 2026 - 06:41 UTC

Update

KernelCare Updates:

The following patchsets are available for ePortal -
- debian12 (K20260811_12)
- ubuntu-noble kernel (K20260811_24)
- ubuntu-noble linux-aws (K20260811_25)
- pve-8 (K20260811_26)
- ubuntu-jammy linux-aws-6.8 (K20260811_27)
- debian11 (K20260811_28)
- rhel10 (K20260812_0007)
- oel10 (K20260812_0008)
- rockylinux10 (K20260812_0009)
- almalinux10 (K20260812_0010)
-debian13 (K20260812_0018) 0
- rhel9 (K20260813_0001)
- almalinux9 (K20260813_0003)
- oel9 (K20260813_0006)
- rockylinux9 (K20260813_0008)
- oel9-uek7 (K20260813_0011)
- oel8-uek7 (K20260813_0012)

In the testing feed:
ubuntu-jammy kernel (K20260817_0001) - this is for the generic 22.04 stream

Pending (almost ready for release):
EL8 family
Posted Aug 18, 2026 - 21:32 UTC

Update

KernelCare livepatches for Zapscape are now in the main feed for:

CloudLinux 9
CloudLinux 10

Subscribed servers on those versions receive the patch automatically on the next update cycle, or immediately with kcarectl --update.

For CloudLinux 10:
The CVE tag is still being added to the CloudLinux 10 patch metadata, so kcarectl --patch-info | grep 'CVE-2026-64561' can return empty on a server that is already patched. Until the metadata lands, verify with kcarectl --info | grep kpatch-build-time instead (build dated August 12, 2026 or later).
Posted Aug 14, 2026 - 04:01 UTC

Update

New KernelCare Releases:

debian12 (K20260811_12) 08-11 12:16
ubuntu-noble kernel (K20260811_24) 08-12 08:04
ubuntu-noble linux-aws (K20260811_25) 08-12 08:04
pve-8 (K20260811_26) 08-12 08:04
ubuntu-jammy linux-aws-6.8 (K20260811_27) 08-12 08:04
debian11 (K20260811_28) 08-12 08:04
rhel10 (K20260812_0007) 08-12 12:14 (CVE metadata missing)
oel10 (K20260812_0008) 08-13 07:13 (CVE metadata missing)
rockylinux10 (K20260812_0009) 08-13 07:13 (CVE metadata missing)
almalinux10 (K20260812_0010) 08-13 07:13 (CVE metadata missing)
rhel9 (K20260813_0001) 08-13 07:12
almalinux9 (K20260813_0003) 08-13 07:19
Posted Aug 13, 2026 - 10:06 UTC

Update

Available KernelCare patches containing the fix:

- Debian 13 release (K20260811_12)
- Ubuntu Noble release (K20260811_24)
- Ubuntu Noble for AWS (K20260811_25)
- Ubuntu Jammy for AWS 6.8 kernels (K20260811_27)
- Proxmox 8 release (K20260811_26)
Posted Aug 12, 2026 - 13:09 UTC

Update

CloudLinux kernel (CloudLinux 7h, CloudLinux 8). Patched kernels:
- CloudLinux 7h: kernel-4.18.0-553.150.1.lve.el7h or newer
- CloudLinux 8: kernel-4.18.0-553.150.1.lve.el8 or newer

The stable channel still carries 553.144.1, so a plain yum update kernel does not pick up this fix yet. The gradual rollout has reached slot 9. To take it right now on CloudLinux 8, either use the rollout bypass repository:
yum update 'kernel*' --enablerepo=cloudlinux-rollout-9-bypass
reboot

or the beta channel:
yum update 'kernel*' --enablerepo=cloudlinux-updates-testing
reboot

On CloudLinux 7h:
yum update 'kernel*' --enablerepo=cl7h_beta
reboot

Once the kernels reach the stable channel, a plain yum update kernel; reboot is enough.

AlmaLinux kernel (CloudLinux 9, CloudLinux 10). Both are already fixed in the AlmaLinux production repositories, no testing repository needed:
- CloudLinux 9: kernel-5.14.0-687.30.1.el9_8 or newer (ALSA-2026:45192)
- CloudLinux 10: kernel-6.12.0-211.39.1.el10_2 or newer (ALSA-2026:45114)

The fix shipped in the July 24 upstream kernel batch, which predates the public disclosure of Zapscape, so a server that took a kernel update in the past two weeks may already be covered. Check with uname -r before planning a reboot window.

dnf update 'kernel*'
reboot

TuxCare ELS kernel (CloudLinux 8 LTS, CloudLinux 9 LTS). The patched kernel-lts package is in preparation. Once it ships, ELS-subscribed customers install it from the TuxCare ELS repository with yum update kernel-lts and reboot.

KernelCare livepatch. Not available for any CloudLinux platform yet. Livepatches are still in preparation for CloudLinux 7h, 8, 9 and 10. From the testing feed once available:
kcarectl --update --prefix test

Once promoted to the main feed, subscribed servers pick it up on the next update cycle, or on demand with kcarectl --update.

How to verify. For a kernel update, compare uname -r against the target version for your platform above. For the livepatch:
kcarectl --patch-info | grep 'CVE-2026-64561'

Use --patch-info for this. kcarectl --info | grep CVE-... comes back empty even on a correctly patched server.

Full advisory and per-platform instructions in the blog post.
Posted Aug 11, 2026 - 13:34 UTC

Identified

Zapscape (CVE-2026-64561) is a vulnerability in the Linux kernel’s KVM code.

For full technical details, visit the CloudLinux Security Blog:
https://blog.cloudlinux.com/zapscape-cve-2026-64561-kvm-guest-escape-and-local-root-mitigation-and-kernel-update-for-cloudlinux/
Posted Aug 10, 2026 - 15:19 UTC
This incident affects: CloudLinux OS Components (CloudLinux Kernel).