ITScape

ITScape: Guest-to-Host Escape in KVM/arm64 Abstract This document describes the ITScape CVE-2026-46316 vulnerability reported and patched by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/arm64 environment and run commands on the host with kerne...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146636 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops...

SUSE CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89912

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 architecture, specifically within the vgic-its component. A malicious guest virtual machine could trigger a null pointer dereference on the host system during a migration save operation. This could lead to a denial ...

CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

DEBIAN-CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

AZL-101547 CVE-2026-89912 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89912 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89912

CVE-2026-89912 affects the Linux kernel in the KVM arm64 vgic-its subsystem. When a guest issues MAPC with V=0 , the ite->collection pointer is nulled while the ITE remains on the device's ITT list. The function vgic_its_save_ite() then dereferences this NULL pointer unconditionally when the V...

EUVD-2026-80512

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89912: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.12 contains a security vulnerability. This vulnerability stems from KVM arm64 vgic-its failing to check for NULL collections when saving ITT, resulting in null pointer dereferencing and potentially causing the host kernel to crash...

PT-2026-93553

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 vgic-its component where the vgic its save ite function unconditionally dereferences a NULL collection. This occurs when a guest issues a sequence of MAP...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command...

Linux ARM virtualization Heap Buffer Overflow DoS

The vulnerability in the vgicitsrestoredte function within the arch/arm64/kvm/vgic/vgic-its.c module of the ARM virtualization subsystem on Linux 64-bit kernel is related to buffer overflow. Exploitation of this vulnerability may allow an attacker to gain access to protected information or cause ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073356)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073356 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098888)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098888 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Remove the reference to the translation cache only for the erased entry. The vgicitsinvalidatecache function iterates through the per-ITS translation cache using xaforeach, and removes the cache reference fo...

KVM ARM64 vGIC-ITS Guest Escape (CVE-2026-46316)

Runs the ITScape PoC vgicitsinvalidatecache double-put UAF on a KVM/arm64 hypervisor host via /dev/kvm. Default payload starts a reverse TCP shell as root on the host new KittySploit session. Marker-only mode creates /ITScape for lab verification. !/usr/bin/env python3 -- coding: utf-8 --...