# CVE-2026-64561: Linux KVM x86 shadow MMU privilege escalation

Source: https://junglewise.ai/threats/cve-2026-64561-linux-kvm-x86-shadow-mmu-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64561 · Severity: high · CVSS 8.8 · Published 2026-08-04

The Linux kernel's virtualization module (KVM) on Intel and AMD processors contains a flaw in memory management that could allow a malicious virtual machine to escape its sandbox and access the underlying host system. This vulnerability could lead to complete compromise of all VMs running on an affected host and theft of data across customer environments. Google has automatically patched its managed Compute Engine infrastructure; however, customers running self-managed virtual machines must update their host kernel as soon as patches are available.

Technologies: [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-64561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64561 being exploited in the wild.

**How severe is CVE-2026-64561?** High severity, with a CVSS score of 8.8, published 4 August 2026.

**Which products and versions are affected?** Linux Kernel x86 KVM module (version range not specified).

**Is there a fix for CVE-2026-64561?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-64561 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-64561?** Check whether you run Google Cloud Platform or Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a privilege escalation vulnerability in the KVM x86 shadow Memory Management Unit (MMU) implementation that affects both Intel and AMD platforms. The vulnerability could allow a guest VM to escape its isolation boundary and execute code with hypervisor-level privileges on the host. The attack is local to the hypervisor and requires no network access or authentication. While no active exploitation has been observed in the wild, this is a high-severity proactive patching effort. Patches are available through upstream Linux kernel distributions; Google Compute Engine managed instances have been automatically mitigated via live patching without customer downtime.

## Affected products

- Linux Linux kernel x86 KVM module (version range not specified)

## Timeline

- 2026-08-07: disclosed
- 2026-08-07: advisory: GCP security bulletin GCP-2026-052 published

## References

- [https://docs.cloud.google.com/support/bulletins/index](https://docs.cloud.google.com/support/bulletins/index)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081)
- [Istio authentication bypass or access control vulnerability](https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080)