CVE-2026-46316 is a vulnerability in the vGIC-ITS emulation within KVM on ARM64 caused by a race condition in the vgic_its_invalidate_cache() function. This race condition results in a double-put use-after-free scenario, enabling an attacker to execute code with host kernel privileges. Because the flaw exists in the in-kernel KVM module rather than user-space QEMU, exploitation leads to host kernel privilege escalation, compromising isolation between guest and host. This vulnerability is particularly relevant to multi-tenant ARM64 cloud infrastructures. It can be exploited even without guest root access by chaining with local privilege escalation techniques. The vulnerability was patched in the Linux kernel at commit 13031fb6b835. Detection is supported by two YARA rules targeting specific constants and behavioral patterns related to the exploit.

Successful exploitation allows a guest virtual machine to escape to the host kernel, gaining host-level privileges and breaking the isolation between guest and host environments. This poses a significant security risk to multi-tenant ARM64 cloud infrastructures by potentially allowing unauthorized access to the host kernel. The vulnerability can be chained with local privilege escalation techniques when guest root access is not available, increasing the attack surface. No known exploits in the wild have been reported to date.

A patch addressing this vulnerability was applied in the Linux kernel at commit 13031fb6b835. Systems running kernel versions including and after this commit are not vulnerable. Users should update their Linux kernels to versions containing this patch to remediate the issue. Since the vulnerability exists in the in-kernel KVM module, updating the kernel is the primary and recommended remediation. Additionally, two YARA rules are available to detect exploitation attempts by identifying specific constants and behavioral patterns associated with this vulnerability.