CVE-2026-46316 is a vulnerability in the Linux kernel's KVM arm64 vgic-its component where the function vgic_its_invalidate_cache() incorrectly drops translation cache references. The function iterates over the per-ITS translation cache and drops references on each entry, but it erroneously puts the iterated pointer rather than the value returned by xa_erase(). Since the function can be called concurrently from different contexts, this leads to multiple drops of the same reference, causing the cache entry to be freed while still mapped by an ITE. This use-after-free condition can cause memory corruption. The fix ensures that only the entry actually removed by xa_erase() is put, preventing double dropping of references.

The vulnerability allows for memory corruption in the kernel's KVM subsystem on ARM64 platforms, potentially leading to system compromise. The CVSS score is 9.3 (critical), indicating high impact on confidentiality, integrity, and availability. Exploitation could allow an attacker with local access to cause kernel memory corruption, which may result in privilege escalation or denial of service. No known exploits in the wild have been reported.

A patch is available and has been released by the vendor. Users should update their Linux kernel to the fixed versions as specified in the vendor advisory and reboot the system to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor's update instructions carefully to ensure full remediation.