CVE-2026-46316 is a vulnerability in the vGIC-ITS emulation within KVM on ARM64 platforms, caused by a race condition in the vgic_its_invalidate_cache() function. This race condition leads to a double-put use-after-free scenario, allowing an attacker to execute code in the host kernel context. Because the flaw resides in the in-kernel KVM module rather than user-space QEMU, exploitation results in host kernel privileges, which is critical in multi-tenant cloud environments. The vulnerability can be leveraged even without guest root access by chaining with local privilege escalation techniques. The affected kernel commits span from 8201d1028caa up to but not including 13031fb6b835, where the patch was introduced. Two YARA detection rules have been created to identify exploitation attempts based on specific constants and behavioral patterns.

Successful exploitation of this vulnerability allows a guest virtual machine to escape to the host kernel, gaining host-level privileges. This compromises the isolation between guest and host, threatening the security of multi-tenant ARM64 cloud infrastructures. The vulnerability also enables chaining with local privilege escalation when guest root access is not available, increasing the attack surface. There are no known exploits in the wild as of the latest information.

A patch fixing this vulnerability was applied in the Linux kernel at commit 13031fb6b835. Systems running kernel versions including and after this commit are not vulnerable. Users should update their kernels to versions including this patch. Since this is an in-kernel KVM vulnerability, updating the kernel is the primary remediation. Additionally, two YARA rules are available to detect exploitation attempts by identifying specific constants and behavioral patterns related to this vulnerability.