Critical Linux Kernel CVE-2024-0001 Lets Guests Escape to Hosts

Key Takeaways

• A critical Linux kernel vulnerability, CVE-2026-46316, affecting ARM64 KVM environments, now has a public proof-of-concept (PoC) exploit.
• The flaw, dubbed “ITScape,” allows guest virtual machines to escape to the host system and execute arbitrary code with kernel-level privileges.
• Discovered by Hyunwoo Kim (V4bel), the vulnerability is a race condition in the vGIC-ITS emulation specific to ARM64 KVM.
• Affected Linux kernel versions span from April 2024 (commit 8201d1028caa) to early June 2026, prior to the fix in commit 13031fb6b835.
• Immediate patching is crucial, especially for cloud providers and environments running untrusted workloads on ARM64 KVM.

A severe vulnerability impacting the Linux kernel, identified as CVE-2026-46316, has been exposed with the public release of a proof-of-concept (PoC) exploit. This critical flaw specifically enables a guest-to-host escape within Kernel-based Virtual Machine (KVM) environments on ARM64 architectures.

Dubbed “ITScape,” the vulnerability grants attackers the ability to break free from a virtual machine, subsequently executing arbitrary commands on the underlying host system with full kernel-level privileges.

Security researcher Hyunwoo Kim, known as V4bel, is credited with discovering this significant flaw. The vulnerability resides within the in-kernel KVM implementation itself, rather than in user-space virtualization components like QEMU.

This characteristic elevates the severity of the issue, as successful exploitation directly compromises the host kernel, bypassing the isolation typically provided by user-space processes.

ITScape stems from a race condition found within the vGIC-ITS (Interrupt Translation Service) emulation, a component of KVM on ARM64 systems. Attackers can trigger specific interrupt-related operations from within a guest VM, exploiting a “double-put” condition that leads to memory corruption. This memory corruption can then be leveraged to achieve arbitrary code execution within the host kernel’s context.

PoC Exploit Details Emerge

The recently released PoC demonstrates a method for triggering the vulnerability entirely from within the guest VM, requiring no interaction from the host system. For the demonstration, the exploit leverages KVM self-tests and operates within a QEMU TCG environment, which emulates an ARM64 host.

The guest code executes carefully crafted GIC/ITS MMIO operations. These operations exploit a flaw in KVM’s interrupt handling logic, ultimately leading to code execution at the host level.

Successful exploitation is evidenced by the creation of a file named “/ITScape” on the host system, owned by the root user. While the PoC is not designed as a fully weaponized tool for real-world attacks, it reliably illustrates the complete exploit chain.

Researcher Hyunwoo Kim (V4bel) commented on GitHub that sophisticated attackers familiar with cloud infrastructure could adapt this technique. By fine-tuning memory offsets, timing conditions, and kernel-specific parameters, real-world exploitation becomes a feasible prospect.

Affected Systems and Implications

The vulnerability impacts Linux kernel versions released between April 2024 (specifically from commit 8201d1028caa) and early June 2026, before the patch introduced in commit 13031fb6b835. Systems utilizing these vulnerable kernel versions in ARM64 KVM environments are at risk, particularly those hosting untrusted or multi-tenant workloads.

This issue poses a significant concern for public cloud providers operating ARM64 infrastructure, where users often possess root access within their virtual machines. In such scenarios, an attacker could exploit this vulnerability to escape their VM, gain control of the host, and potentially compromise other tenants or workloads residing on the same physical system.

It is important to note that this vulnerability does not extend to x86 systems, as its root cause is specific to the ARM64 KVM subsystem within the Linux kernel’s virtualization code.

What You Should Do

• Apply Patches Immediately: Update your Linux kernel to a version that includes commit 13031fb6b835 or later. Verify that your systems are no longer running vulnerable kernel versions.
• Monitor for Unusual Activity: Implement robust monitoring for unusual behavior within virtual machines, especially those running on ARM64 KVM.
• Limit Untrusted Guests: Exercise caution when hosting untrusted or multi-tenant workloads on affected ARM64 KVM systems until patches are fully deployed.
• Stay Informed: Keep abreast of further security research and advisories concerning KVM escape techniques and virtualization vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.