ITScape

ITScape: Guest-to-Host Escape in KVM/arm64 Abstract This document describes the ITScape CVE-2026-46316 vulnerability reported and patched by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/arm64 environment and run commands on the host with kerne...

CVE-2026-89912

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 architecture, specifically within the vgic-its component. A malicious guest virtual machine could trigger a null pointer dereference on the host system during a migration save operation. This could lead to a denial ...

CVE-2026-89913

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

DEBIAN-CVE-2026-89913

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

AZL-101547 CVE-2026-89912 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

DEBIAN-CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89913 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

EUVD-2026-80513

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

CVE-2026-89913 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned struct vgicirq in the loop body without holding a reference on the LP...

CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89912

CVE-2026-89912 affects the Linux kernel in the KVM arm64 vgic-its subsystem. When a guest issues MAPC with V=0 , the ite->collection pointer is nulled while the ITE remains on the device's ITT list. The function vgic_its_save_ite() then dereferences this NULL pointer unconditionally when the V...

EUVD-2026-80512

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

Linux Distros Unpatched Vulnerability : CVE-2026-89913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic-v3: take an LPI reference in vgicv3savependingtables vgicv3savependingtables iterates dist-lpixa using xaforeach and dereferences the returned...

CVE-2026-89912: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check whether the vCPU is not NULL in vgicv2parseattr. vgicv2parseattr is responsible for finding the vCPU that matches the user-provided CPUID. This CPUID may, of course, be invalid. If the ID is invalid,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107310 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgicv2parseattr vgicv2parseattr is responsible fo...

The vulnerability of the vgic_its_restore_dte() function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM virtualization subsystem in the 64-bit Linux operating system allows a attacker to access protected information or cause service failure.

The vulnerability of the vgicitsrestoredte function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM 64-bit kernel-based Linux operating system involves the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to access...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073356)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073356 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore ...