A proof-of-concept (PoC) exploit has been publicly released for a critical Linux kernel vulnerability tracked as CVE-2026-46316, dubbed ITScape, that allows a malicious guest virtual machine to escape its sandbox and execute arbitrary commands on the host system with full kernel (root) privileges.
Researcher Hyunwoo Kim (@v4bel) discovered and patched the flaw, marking what is believed to be the first publicly documented guest-to-host escape exploit targeting KVM/arm64.
ITScape exploits a race condition in the vGIC-ITS (Interrupt Translation Service) emulation within KVM/arm64, the in-kernel hypervisor component responsible for managing ARM’s virtualized interrupt controller.
PoC Released for Linux Kernel Guest-to-Host Escape
Unlike the more commonly reported QEMU-based escape vulnerabilities, which exploit bugs in QEMU’s user-space emulation layer, this flaw resides entirely within the in-kernel KVM subsystem (arch/arm64/kvm/vgic/).
This distinction is critical: successful exploitation grants host kernel privilege rather than merely the privilege of the QEMU process.
The attack is triggered entirely through guest-side actions, specifically by manipulating GIC/ITS MMIO from within the guest requiring no cooperation from the host. The exploit chain uses a double-put primitive to execute host kernel code, Hyunwoo Kim said.
The vulnerability affects Linux kernel versions from commit 8201d1028caa (April 25, 2024) through commit 13031fb6b835 (June 5, 2026). The scope is limited to ARM64 KVM hosts; x86 and other architectures are unaffected.
The primary threat targets multi-tenant ARM64 public cloud environments, where untrusted guest VMs share a common physical host. Exploiting the flaw requires guest root (EL1) privilege, which is typically satisfied when a cloud tenant controls their own VM instance.
In scenarios lacking guest root, the attacker would need to chain ITScape with a local privilege escalation such as the previously disclosed Dirty Frag vulnerability.
The released PoC is built on top of the Linux kernel’s kvm selftest framework and is designed for demonstration against kernel version v7.1-rc6, the last release before the patch landed.
It is not a fully weaponized exploit ready for immediate deployment against production cloud infrastructure.
However, Hyunwoo Kim notes that an attacker with knowledge of a target cloud’s virtualization stack would find weaponization relatively straightforward, requiring address tuning, gadget selection, race timing adjustments, and porting the host-side path to a real guest-driven attack.
A weaponized exploit reportedly exists but is being withheld from public release. On successful exploitation of the PoC, the guest escapes its isolation boundary and creates a /ITScape file on the host filesystem, owned by uid=0 confirming full host kernel code execution.
The fix was introduced in commit 13031fb6b835 on June 5, 2026. Operators running ARM64 KVM hosts, particularly cloud providers, should verify the patch is applied immediately.
Cloud tenants should confirm with their providers that the host kernels have been updated. The researcher also warns that ITScape represents a new class of vulnerability, and additional variants targeting the same subsystem should be anticipated.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 exploit has been publicly released for a critical Linux kernel vulnerability tracked as CVE-2026-46316, dubbed ITScape, that allows a malicious guest virtual machine to escape its sandbox and execute arbitrary commands on the host system with full kernel (root) privileges.){kind=link}