ITScape (CVE-2026-46316)

VM-to-host escape (arm64 only)

ITScape is a VM-to-host escape in the Linux kernel's KVM/arm64 subsystem. A tenant with root inside their own VM can corrupt the host kernel and run code as root on the hypervisor, breaking isolation from every other VM on that host. This flaw is arm64 only. It does not affect x86_64 hosts.

Applies to VirtFusion arm64 hypervisors only

This advisory is relevant only to arm64 hypervisors. Any x86_64 hypervisor is unaffected. If all of your hypervisors are x86_64, this advisory does not apply to you; see Januscape and Zapscape instead.

Summary

Field	Detail
CVE	CVE-2026-46316
Nickname	ITScape (part of "The KVM Escape Trilogy", alongside Januscape and Zapscape)
Component	Linux kernel, KVM/arm64 vGIC-ITS emulation (arch/arm64/kvm/vgic/)
Class	Double-free use-after-free (UAF)
Impact	VM-to-host escape, leading to arbitrary code execution as root on the host
Architecture	arm64 only. x86_64 hosts are not affected.
Introduced	Commit 8201d1028caa (2024-04-25)
Upstream fix	Commit 13031fb6b835 (merged mainline 2026-06-05)
Where it applies	VirtFusion arm64 hypervisors. This does not affect the VirtFusion control server.

Am I affected?

ITScape affects the host kernel on arm64 hypervisors only. It is not a VirtFusion application flaw and does not affect the control server or any x86_64 host. You are potentially exposed if all of the following are true:

• The hypervisor is arm64 and runs an unpatched Linux kernel that includes the vulnerable vGIC-ITS code, introduced in April 2024.
• A VM is controlled by an untrusted party with root inside the VM, which is the normal situation in a multi-tenant hosting environment.

The vulnerable code arrived in 2024, so kernels that branched earlier do not contain it. Debian 12 (bookworm) is not affected because its 6.1 kernel predates the flaw. The RHEL-family kernels backported the affected code and are affected. See the table below for the exact status of each arm64 platform.

Technical details

ITScape is a double-free use-after-free in KVM's virtual GIC Interrupt Translation Service (vGIC-ITS) emulation. The function vgic_its_invalidate_cache() performs a double-put on a reference count, which frees an object that is still in use and lets a VM drive the host kernel into reusing freed memory. The bug lives entirely inside in-kernel KVM rather than QEMU user space, so a successful exploit yields host kernel privilege rather than a user-process compromise.

Triggering it requires root inside the VM to drive GIC/ITS MMIO operations, a VM with at least two vCPUs, and precise timing to win the race. It was disclosed as the first VM-to-host escape research targeting KVM/arm64.

The upstream fix (13031fb6b835) corrects the reference counting so the object can no longer be freed while still referenced. The disclosure also points to a related fix (CVE-2026-46317); a current distribution kernel includes both.

Patch status by distribution

VirtFusion runs arm64 hypervisors on Debian 12/13 and RHEL-family 9/10 (AlmaLinux / Rocky), so those are the platforms tracked here.

This is a point-in-time snapshot

The state below reflects 2026-08-08. Distribution patch status changes as errata ship. Always confirm against the vendor's live security tracker (linked in References) before deciding a host is safe.

Distribution (arm64)	Status	Fixed kernel / advisory
Debian 12 (bookworm)	Not affected	Vulnerable code not present in the 6.1 kernel
Debian 13 (trixie)	Patched	linux 6.12.101-1 (DSA-6355-1)
RHEL 9 / AlmaLinux 9 / Rocky 9	Patched	kernel-5.14.0-687.22.1.el9_8 or newer (RHSA-2026:36018)
RHEL 10 / AlmaLinux 10 / Rocky 10	Patched	kernel-6.12.0-211.30.1.el10_2 or newer (RHSA-2026:34911)

• Debian 12 (bookworm): The vulnerable vGIC-ITS code was introduced after bookworm's kernel branched, so bookworm is not affected and no action is required for ITScape.
• Debian 13 (trixie): Fixed in linux 6.12.101-1 (DSA-6355-1). Update and reboot.
• RHEL 9 / AlmaLinux 9 / Rocky 9: Fixed. Install kernel-5.14.0-687.22.1.el9_8 or newer and reboot.
• RHEL 10 / AlmaLinux 10 / Rocky 10: Fixed. Install kernel-6.12.0-211.30.1.el10_2 or newer and reboot.

Remediation

The fix is a host kernel update followed by a reboot on every affected arm64 hypervisor. A kernel update does not take effect until the host is running the new kernel, so the reboot is required.

Debian

apt-get update -y && apt-get install --only-upgrade linux-image-arm64 -y
# Reboot into the new kernel once VMs are migrated/stopped:
reboot

RHEL / AlmaLinux / Rocky

dnf makecache -y && dnf update kernel -y
# Reboot into the new kernel once VMs are migrated/stopped:
reboot

After rebooting, confirm the host is running a fixed kernel:

uname -r

Compare the output against the fixed version in the table above.

No interim mitigation

Unlike the x86 issues in this series, ITScape has no practical mitigation short of patching. It does not depend on nested virtualization, and the vGIC-ITS cannot simply be disabled because it provides MSI delivery that arm64 VMs rely on. Affected arm64 hosts should therefore be patched and rebooted as a priority.

References

• ITScape write-up and PoC (V4bel/ITScape)
• oss-security disclosure, ITScape (CVE-2026-46316)
• Debian security tracker, CVE-2026-46316
• Red Hat, CVE-2026-46316