Exploit discussion active in current signal (1 latest mentions)
Immediate actions
Patch linux linux_kernel systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: High priority (within 72h)
NVD description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
vgic_its_invalidate_cache() walks the per-ITS translation cache with
xa_for_each() and drops the cache's reference on each entry with
vgic_put_irq(). It puts the iterated pointer, though, rather than the
value returned by xa_erase().
The function is called from contexts that do not exclude one another: the
ITS command handlers hold its_lock, the GITS_CTLR write path holds
cmd_lock, and the path that clears EnableLPIs in a redistributor's
GICR_CTLR holds neither. Two or more of them can drain the same cache
concurrently, and if each one observes the same entry, erases it and then
puts it, the single reference the cache holds on that entry is dropped
more than once. The entry can then be freed while an ITE still maps it.
xa_erase() is atomic and returns the previous entry, so put only the entry
that this context actually removed. The cache reference is then dropped
exactly once per entry even when the invalidations run concurrently, and
the behavior is unchanged when only one context runs.
🚨 Introducing "ITScape" (CVE-2026-46316)
A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel.
Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds.
To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64.
Details: https://itscape.io
Post summary
A new CVE-2026-46316, a Guest-to-Host escape in KVM/arm64 caused by a use-after-free, is disclosed with a link to further details; no exploit code, active exploitation, or patch information is provided.
⚠️ PoC Exploit Released for Guest-to-Host Escape Linux Kernel Vulnerability
Source: https://cybersecuritynews.com/poc-exploit-released-linux-kernel-vulnerability/
A proof-of-concept (PoC) exploit has been released for a critical Linux kernel vulnerability, CVE-2026-46316, that enables a guest-to-host escape in KVM environments on arm64 systems.
The vulnerability was discovered by security researcher Hyunwoo Kim (V4bel) and affects the in-kernel KVM implementation rather than user-space components like QEMU.
This makes the issue particularly severe, as exploitation results in a direct compromise of the host kernel rather than a confined user-space process. ITScape is caused by a race condition in the vGIC-ITS (Interrupt Translation Service) emulation within KVM on arm64.
#cybersecuritynews
Post summary
A proof‑of‑concept exploit for CVE‑2026‑46316, a critical Linux kernel guest‑to‑host escape on arm64 KVM environments, has been released, underscoring a race‑condition flaw in vGIC‑ITS.
Se ha publicado un exploit de prueba de concepto (PoC) para una vulnerabilidad crítica del núcleo de Linux, identificada como CVE-2026-46316
“ITScape”, permite a un atacante realizar un escape de invitado a anfitrión en entornos KVM sobre sistemas arm64, lo que facilita la salida de una máquina virtual para ejecutar comandos arbitrarios en el host con privilegios totales a nivel de kernel
https://blog.elhacker.net/2026/06/lanzan-poc-de-vulnerabilidad-de-escape.html
Post summary
A PoC named ITScape for CVE-2026-46316 has been released, demonstrating a guest-to-host escape on arm64 KVM environments.
Pwnies this year a joke or something (who am i kidding every year?)
Best RCE:
Winner: ITScape: Guest-to-Host escape in KVM/arm64 (CVE-2026-46316) <- a bug which requires a shell/foothold on a target? (awesome bug. but ..)
Remote authentication bypass in the GNU InetUtils telnetd (CVE-2026-24061) <- a daemon not in use anywhere.
SELECT shell FROM postgres (CVE-2026-2006) <- probably never going to be exploited ITW.
but not the preauth wordpress rce by @assetnote ...?
Post summary
The post lists several CVEs and gives brief technical notes, but does not provide PoC code, exploit tools, active exploitation evidence, or mitigation details.
CVE‑2026‑46316 is a KVM/arm64 kernel escape vulnerability for which proof‑of‑concept code and detailed exploitation steps have been released, along with an existing patch from the Linux kernel developers. No evidence of active exploitation or false‑positive claims is provided.
CVE-2026-46316,ITScape: Linux kernel: Guest-to-Host Escape in KVM/arm64 https://openwall.com/lists/oss-security/2026/06/10/16
"execute commands on the host with kernel privileges (root). As far as is publicly known, this is the first guest-to-host escape exploit research targeting KVM/arm64"
Exploit attached
Post summary
The post discloses that CVE-2026-46316 is a guest‑to‑host escape in KVM/arm64, provides attached exploit code enabling root execution, but does not report active exploitation or a patch.
16 let stará chyba v Linux KVM umožňuje útěk hostovaného VM na hostitele
Nově zveřejněná zranitelnost s přezdívkou Januscape, evidovaná jako CVE-2026-53359, ukazuje, jak dlouho se může závažná chyba skrývat v základní infrastruktuře. Bezpečnostní výzkumník Hyunwoo Kim objevil chybu typu use-after-free v kódu shadow MMU hypervizoru KVM v Linuxu — kódu, který sdílejí implementace pro Intel i AMD x86. Podle Kima jde o první veřejně známý únik z hosta na hostitele (guest-to-host escape), který funguje na obou platformách, a samotná chyba se v jádru zřejmě skrývala nepovšimnuta od zhruba roku 2010. Chyba byla původně nahlášena v rámci programu Google kvmCTF, který za prokázané úniky z hosta na hostitele nabízí odměnu až 250 000 dolarů.
Technicky problém spočívá v tom, jak KVM spravuje tzv. "shadow pages" (stínové stránky) — interní struktury, kterými si mapuje rozvržení paměti hostovaného VM. Když KVM takovou stránku potřebuje, hledá, zda může znovu použít nějakou existující. Chybná kontrola ale stránky porovnávala pouze podle paměťové adresy (gfn) a ignorovala jejich "roli", takže se mohly zaměnit dva strukturálně odlišné typy stránek. Tato záměna naruší interní evidenci KVM. Ve většině případů jádro nesrovnalost odhalí a raději samo spadne, aby se ochránilo — přesně to dělá veřejně dostupný proof-of-concept: škodlivý host dokáže shodit celý hostitelský server a s ním i všechny ostatní VM na stejném stroji. Ve vzácnějším a nebezpečnějším scénáři je uvolněná stránka přidělena k jinému účelu dřív, než proběhne úklid, což způsobí zápis do paměti, kterou už jádro nevlastní. Podle Kima lze z tohoto omezeného přístupu vybudovat plnohodnotné spuštění kódu na hostiteli, tento exploit však zatím nebyl zveřejněn.
Zneužití vyžaduje na straně hosta dvě podmínky: root přístup uvnitř VM (běžný u pronajatých cloudových instancí) a hostitelem povolenou vnořenou virtualizaci (nested virtualization). Důležité je, že i hostitelé, kteří běžně využívají hardwarově akcelerované stránkování (Intel EPT / AMD NPT), se při zapnuté vnořené virtualizaci vracejí ke zranitelné starší cestě shadow MMU, a útok navíc nevyžaduje žádnou součinnost QEMU ani jiné userspace komponenty. Na distribucích, kde je /dev/kvm zapisovatelné pro kohokoliv (např. RHEL), Kim upozorňuje, že stejnou chybu lze zneužít i k lokální eskalaci práv na root.
Januscape je již třetí Kimovo odhalení chyby v jádru Linuxu za zhruba dva měsíce, po Dirty Frag (řetězec zápisů do page cache, zveřejněný v květnu) a ITScape, prvním veřejně demonstrovaném úniku z hosta na hostitele na KVM/arm64 (zveřejněný v červnu). Navazuje také na příbuznou, ale odlišnou chybu use-after-free ve shadow MMU, CVE-2026-46113, opravenou v květnu 2026 — tato starší část kódu tak za necelých šedesát dní přinesla už dvě samostatné chyby typu use-after-free.
Opravu napsal správce KVM Paolo Bonzini a přidává jediný řádek kontroly, díky němuž se stínová stránka znovu použije pouze tehdy, pokud se shoduje jak její paměťová adresa, tak role. Do hlavní vývojové větve byla začleněna 19. června 2026 jako commit 81ccda30b4e8. Opravené stabilní verze jádra vyšly 4. července 2026 (7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211 a 5.10.260), zatím jim ale NVD nepřiřadila skóre CVSS. Protože backporty distribucí mohou opravu nést pod jiným číslem verze, správci by měli ověřit přítomnost konkrétního commitu, a nespoléhat jen na uname -r. Kdo nemůže záplatovat okamžitě, může riziko zmírnit vypnutím vnořené virtualizace (kvm_intel.nested=0 nebo kvm_amd.nested=0) pro nedůvěryhodné hosty. Chyba Januscape se netýká hostitelů s architekturou ARM64, ta je ale zasažena samostatnou zranitelností ITScape (CVE-2026-46316) na KVM/arm64.
Post summary
The article announces CVE‑2026‑53359, a guest‑to‑host escape via a use‑after‑free in KVM’s shadow MMU, provides a public PoC that crashes the host, and describes a kernel patch and mitigations, without evidence of active exploitation.
🚨 Linux kernel içinde KVM sanallaştırma altyapısının ARM64 tarafında ciddi bir güvenlik açığı tespit edildi. Bu açık bir sanal makinenin (guest) host kernel seviyesine çıkmasına yol açabiliyor. x86_64 etkilenmiyor. POC Exploit yayınlandı.
CVE ID: CVE-2026-46316
Post summary
CVE‑2026‑46316 is a newly disclosed ARM64 KVM kernel vulnerability that lets a guest reach host kernel privileges, and a PoC exploit has been released, though no live exploitation or patch has been reported.
CVE-2026-46316 is a critical Linux KVM arm64 flaw scoring 9.3 that lets a guest VM escape to the host kernel via a vGIC-ITS race condition.
#CVE202646316#KVMEscape#LinuxKernel#arm64#CloudSecurity
https://meterpreter.org/cve-2026-46316-kvm-arm64-escape https://t.co/rjE4Xnl2N0
Post summary
The post announces CVE-2026-46316, a critical KVM arm64 flaw with a 9.3 score, and provides a link likely containing a proof‑of‑concept, but it does not mention active exploitation, patches, or false‑positive status.
CVE-2026-46316 (ITScape) is a guest-to-host escape in KVM/arm64 yielding host root, discovered by researcher Hyunwoo Kim (V4bel). Organizations operating multi-tenant cloud infrastructure should closely evaluate this issue. RL has provided two YARA rules for detection. https://www.reversinglabs.com/blog/defend-cloud-infrastructure-itscape
Post summary
The text announces a newly discovered guest-to-host escape (CVEs CVE‑2026‑46316) in KVM/arm64 that can grant host root, provides YARA detection rules, but offers no exploit, patch, or evidence of active exploitation.
The ITScape KVM escape vulnerability (CVE-2026-46316) threatens arm64 clouds. Details and a guest-to-host escape exploit PoC are now publicly disclosed.
#ITScape#KVM#CVE2026_46316#Cybersecurity#Exploit#PoC
https://securityonline.info/itscape-kvm-escape-cve-2026-46316-poc/ https://t.co/4P9gcxhCaK
Post summary
The post announces the public release of a Proof of Concept for the CVE‑2026‑46316 KVM escape on arm64 clouds, with no indication of active exploitation or patch availability.
Weekly threat recap: supply-chain intrusions, Microsoft token phishing, cloud and identity abuse, plus ransomware and extortion cases. Also covered defenses tied to CVE-2026-46316. #ShaiHulud#EntraID#Ransomware
https://ift.tt/5uGemQV
Post summary
The tweet offers a high‑level threat recap that references CVE‑2026‑46316 with defensive coverage noted, but provides no technical, exploit, patch, or active exploitation details.
#Kernel_Security
ITScape: Guest-to-Host Escape in KVM/arm64
https://github.com/V4bel/ITScape
// CVE-2026-46316 + PoC. If you are not on an arm64 KVM host, you do not need to worry about this vulnerability
http://www.cyberpocket.org
Post summary
A proof‑of‑concept for CVE‑2026‑46316—an arm64 KVM guest‑to‑host escape—has been publicly released and linked, without indication of active attacks or patches.
ITScape (CVE-2026-46316): New guest-to-host escape in KVM/arm64 enables host kernel execution from untrusted guests. Critical threat to multi-tenant ARM64 cloud environments with direct compromise potential.
Key technical details:
• Race condition in vgic_its_invalidate_cache() causes double-put use-after-free in vGIC-ITS emulation
• Affects kernels from commit 8201d1028caa (2024-04-25) through patch at 13031fb6b835 (2026-06-05)
• Exploitation yields host kernel privilege, not just userspace compromise
• Can be chained with local privesc when attacker lacks guest root access
Detection opportunities:
• Two YARA rules provided: ITScape_ExploitConstants_1 targets hardcoded 64-bit kernel addresses and payload strings
• ITScape_KVM_PrivDrop_1 detects behavioral pattern: stat() check on /dev/kvm followed by setgroups/setgid/setuid(1000)
• Monitor for unusual /dev/kvm access patterns and privilege dropping sequences
Impact scope:
• Primarily threatens ARM64 cloud providers and multi-tenant virtualization platforms
• New vulnerability class suggests additional variants likely to emerge
• Requires only guest kernel privilege to achieve host root compromise
Priority patch application for arm64 KVM hosts. Hunt for /dev/kvm access anomalies and implement the provided YARA rules for PoC detection.
#DFIR_Radar
Post summary
The post announces a new guest-to-host escape vulnerability (CVE-2026-46316) in KVM/arm64, provides technical details and detection YARA rules, and urges priority patching of affected hosts.
3/ CVE-2026-46316 is a race in vgic_its_invalidate_cache(). Concurrent invalidators can put the same cache reference more than once. The resulting use-after-free became host-kernel code execution in the researcher's controlled test.
Post summary
The passage describes a race condition and use‑after‑free in CVE‑2026‑46316 leading to host‑kernel code execution, without providing a PoC, exploit code, active exploitation evidence, or mitigation details.
CVE-2026-46316: ⚠️ PoC Exploit Released for Guest-to-Host Escape Linux Kernel Vulnerability Source: A proof-of-concept (PoC) exploit has been released for a critical Linux kernel vulnerability, CVE-2026-46316, that enables a guest-to-host escape in…
Post summary
A proof‑of‑concept exploit for CVE‑2026‑46316, enabling guest‑to‑host escape in the Linux kernel, has been released, confirming the vulnerability’s severity. No active exploitation, patches, or code specifics are mentioned.
A proof-of-concept (PoC) exploit has been released for a critical Linux kernel vulnerability, CVE-2026-46316, that enables a guest-to-host escape in KVM environments on
Post summary
A proof‑of‑concept exploit for the critical Linux kernel CVE‑2026‑46316, which allows guest‑to‑host escape in KVM, has been released; no patch, workaround, or active exploitation claims are reported.
Tuesday action: verify patch 81ccda30b4e8 is applied to your x86 KVM hosts. If you're a cloud tenant, ask your provider. If you skipped ITScape (CVE-2026-46316) on arm64, patch both.
Post summary
The message urges applying a specific patch (81ccda30b4e8) to address CVE‑2026‑46316 on x86 KVM hosts and reminds cloud tenants to ensure their provider applies the fix on arm64 hosts.
A PoC exploit for CVE-2026-46316, a critical Linux kernel vulnerability, enables guest-to-host escapes in KVM on arm64 systems. This flaw, dubbed 'ITScape,' allows attackers to execute arbitrary commands on the host with full kernel privileges. Security teams should apply patches immediately to mitigate this risk.
#LinuxKernel#KVM#ITScape#CyberSecurity#Vulnerability#ARM64
https://thedailytechfeed.com/poc-exploit-released-for-critical-linux-kernel-guest-to-host-escape-vulnerability/
Post summary
The post announces a PoC exploit for CVE-2026-46316, a critical Linux kernel guest‑to‑host escape, and urges immediate patching to mitigate the risk.
Meet ITScape. CVE-2026-46316.
Guest-to-host escape in KVM/arm64 via use-after-free. Guest-side actions alone are enough to run root-privileged code in the host kernel.
Unlike QEMU escapes - this lives in in-kernel KVM itself. Harder to patch. Wider blast radius.
Two hypervisor escapes in one day. Today is a bad day for virtualization.
http://VulnTracker.io
Post summary
The post announces CVE-2026-46316, a use‑after‑free in KVM/arm64 that permits guest‑side root code execution on the host, with no PoC, tool, patch or active exploitation details provided.
