Security Advisories
This section documents security issues that affect VirtFusion hypervisors, with patch status for the Linux distributions VirtFusion supports (Debian 12/13, Ubuntu 22.04/24.04, and RHEL-family 9/10). Each advisory explains what the issue is, whether your hosts are affected, how to patch, and how to mitigate in the meantime.
The KVM Escape Trilogy
During 2026, security researcher Hyunwoo Kim (V4bel) disclosed three related VM-to-host escape vulnerabilities in KVM, collectively called "The KVM Escape Trilogy". All three can affect VirtFusion hypervisors, split by CPU architecture:
- Januscape (CVE-2026-53359): x86 (Intel and AMD). A use-after-free in the KVM shadow MMU, present since 2010.
- Zapscape (CVE-2026-64561): x86 (AMD, and Intel under a specific EPT condition). A use-after-free in the KVM shadow MMU.
- ITScape (CVE-2026-46316): arm64 only. A double-free use-after-free in KVM's vGIC-ITS emulation. VirtFusion runs arm64 hypervisors on Debian 12/13 and RHEL-family 9/10. Debian 12 is not affected (the flaw was introduced after its kernel branched); Debian 13 and the RHEL family are affected and fixed.
Which advisories apply to a given hypervisor depends on its CPU: x86_64 hosts are exposed to Januscape and Zapscape, while arm64 hosts are exposed to ITScape.
Timeline
"Mainline fix" is the date the upstream kernel fix was committed. Distribution kernels shipped afterwards, so check each advisory for the exact fixed package versions.
| Date | Event |
|---|---|
| 2010-08-01 | Januscape flaw introduced in KVM/x86, roughly 16 years before disclosure |
| 2024-04-25 | ITScape flaw introduced in KVM/arm64 (after Debian 12's kernel branched) |
| 2026-06-05 | ITScape mainline fix committed (CVE-2026-46316) |
| 2026-06-10 | ITScape publicly disclosed |
| 2026-06-16 | Januscape mainline fix committed (CVE-2026-53359) |
| 2026-07-06 | Januscape publicly disclosed |
| 2026-07-21 | Zapscape mainline fix committed (CVE-2026-64561) |
| 2026-07-22 | RHEL / AlmaLinux / Rocky 9 ship the Zapscape fix |
| 2026-08 | Zapscape proof-of-concept publicly disclosed |
What to do
In every case the fix is the same: patch the host kernel and reboot. See the per-distribution fixed versions in each advisory. The interim options differ by architecture:
- x86_64 hosts (Januscape, Zapscape): if a fixed kernel is not yet available, disable nested virtualization as an interim mitigation. The full procedure is in each advisory.
- arm64 hosts (ITScape): there is no practical mitigation short of patching, so affected hosts (Debian 13 and RHEL-family 9/10) should be updated as a priority.
Start with the advisory for the issue you are checking:
- Januscape (CVE-2026-53359) (x86)
- Zapscape (CVE-2026-64561) (x86)
- ITScape (CVE-2026-46316) (arm64)