ITScape Vulnerability and Guest-to-Host Escape in KVM/ARM64

Disclosed in June 2026, ITScape (CVE-2026-46316) represents a critical security flaw in ARM64-based cloud infrastructure utilizing KVM. The vulnerability resides within the Interrupt Translation Service (vGIC-ITS) emulation in the Linux kernel. A race condition in the vgic_its_invalidate_cache() function allows for a double-put use-after-free (UAF) condition.

Unlike traditional escapes that target user-space emulators like QEMU, this exploit occurs entirely within the host's in-kernel KVM implementation. Successful exploitation allows an attacker with guest kernel privileges to achieve code execution with host kernel privileges. This makes ITScape a Tier-1 threat for multi-tenant cloud providers and infrastructure-as-a-service (IaaS) platforms running ARM64 workloads.

Organizations should prioritize patching kernels between versions 2024-04-25 (commit 8201d1028caa) and 2026-06-05 (commit 13031fb6b835). ReversingLabs has provided detection artifacts including YARA rules to identify PoC-based exploitation attempts.