Skip to main content

Linux Kernel EUVDEUVD-2026-35405

| CVE-2026-46316 CRITICAL
Improper Update of Reference Count (CWE-911)
2026-06-09 Linux GHSA-qcxh-2cm7-9fcc
Information Disclosure Linux
9.3
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Run code in arm64 KVM guest
  2. Delivery
    Populate ITS translation cache with mappings
  3. Exploit
    Issue ITS DISCARD on one vCPU
  4. Install
    Race GITS_CTLR/EnableLPIs writes on another vCPU
  5. C2
    Double-put on same cache entry frees vgic_irq
  6. Execute
    Reference freed object via ITE
  7. Impact
    Pivot UAF to host kernel code execution

Vulnerability Assessment

Weakness
CWE
CWE-911
Exploitation Conditions

Attacker must execute code inside a KVM-arm64 guest whose virtual machine definition enables the vGIC-ITS (the GICv3 Interrupt Translation Service) - the bug is in vGIC-ITS emulation and cannot be reached without it. The guest must be able to issue ITS commands and write GITS_CTLR/GICR_CTLR registers, which is the default for any guest configured with ITS. Exploitation requires winning a race between at least two of the three unsynchronised invalidation paths (its_lock-held command handler, cmd_lock-held GITS_CTLR writer, lock-free EnableLPIs clear), so the attacker needs SMP/multi-vCPU access to drive concurrent invalidations. Limiting factors: x86 hosts, arm64 hosts not running KVM, and KVM-arm64 guests configured without ITS are not exploitable; single-vCPU guests cannot drive the concurrent paths simultaneously.
Impact

Signals conflict sharply. The NVD CVSS 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects worst-case kernel memory corruption with scope change from guest to host, but AC:L understates the race-condition nature of the bug - winning a three-way concurrent xa_erase race is non-trivial, and PR:N is generous given the attacker must already control a KVM-arm64 guest with vGIC-ITS emulation enabled. EPSS at 0.02% (5th percentile) and absence from CISA KEV both indicate no observed exploitation, consistent with the narrow prerequisite of being an arm64 KVM tenant. The realistic priority is moderate for arm64 cloud/hypervisor operators (Ampere, AWS Graviton, bare-metal arm64 KVM) and low for everyone else, including all x86 deployments which are not affected. Tag 'Information Disclosure' in the input understates impact - successful exploitation is a use-after-free that supports full host compromise, not merely info disclosure.
Exploit ScenarioDerived

A malicious workload running inside an arm64 KVM guest issues a stream of ITS commands (e.g. DISCARD, MAPI/MAPTI churn) while simultaneously toggling GITS_CTLR.Enable and clearing GICR_CTLR.EnableLPIs from multiple vCPUs, racing two cache-invalidation paths through vgic_its_invalidate_cache() so that the same xarray entry is erased twice and its host-kernel vgic_irq refcount is decremented past zero. The freed structure is then re-referenced through a still-mapped ITE, giving the guest a use-after-free primitive on the host that is the standard starting point for full host kernel privilege escalation and VM escape. No public exploit identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Use-after-free in the KVM arm64 vGIC-ITS translation cache allows a malicious guest to corrupt host kernel memory by triggering concurrent cache invalidations that double-drop a single reference. The flaw affects Linux 6.10 and later until the stable backports, has no public exploit identified at time of analysis, and EPSS rates real-world exploitation probability as very low (0.02%, 5th percentile) despite the CVSS 9.3 rating.

RemediationAI

Vendor-released patch: upgrade to Linux 6.12.93, 6.18.35, 7.0.12, or 7.1-rc7 or later, applying the appropriate stable backport from git.kernel.org/stable/c/b7b72e88046328c9fdc638fe887d4240257dd5dc (mainline) or the matching stable commits 2bbc395e, 9121f460, 13031fb6. Distribution-shipped kernels should be updated through normal channels once the backport lands (see https://nvd.nist.gov/vuln/detail/CVE-2026-46316 and https://seclists.org/oss-sec/2026/q2/877 for tracking). If immediate kernel update is not possible on arm64 KVM hosts, the only meaningful compensating control is to stop running untrusted guests with vGIC-ITS emulation - either disable ITS in the guest virtual machine definitions (which removes MSI/LPI support and degrades interrupt performance for PCIe passthrough and high-throughput virtio devices) or restrict guest creation to trusted tenants until the host is patched; firewalling does not help because the attack surface is intra-host.

Affected VersionsENISA

Linux patch: 7.1-rc7
Linux 8201d1028caa4fae88e222c4e8cf541fdf45b821 <9121f4605ab94969f62d1b5714ca3c6c69bd202f
Linux 6.10
Linux 8201d1028caa4fae88e222c4e8cf541fdf45b821 <13031fb6b8357fbbcded2a7f4cba73e4781ee594
Linux patch: 0
Linux 8201d1028caa4fae88e222c4e8cf541fdf45b821 <b7b72e88046328c9fdc638fe887d4240257dd5dc
Linux patch: 7.0.12
Linux 8201d1028caa4fae88e222c4e8cf541fdf45b821 <2bbc395e81bd29c543a0529a678327e932a7ec69
Linux patch: 6.18.35
Linux patch: 6.12.93

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerable code lives in arch/arm64/kvm/vgic/vgic-its.c, which implements emulation of the GICv3 Interrupt Translation Service for KVM-virtualised arm64 guests. vgic_its_invalidate_cache() iterates an xarray-backed per-ITS translation cache using xa_for_each() and drops each entry's refcount via vgic_put_irq(), but it passes the iteration pointer instead of the value returned by the atomic xa_erase(). Three call sites can run concurrently without mutual exclusion - ITS command handlers (its_lock), the GITS_CTLR write path (cmd_lock), and the EnableLPIs clear path in GICR_CTLR (no lock) - so two contexts can each observe, erase and put the same entry, dropping the single cache-held reference more than once. This is a classic CWE-416 (use-after-free) caused by a CWE-362 race condition; the freed irq descriptor can still be referenced by an outstanding ITE mapping, giving an attacker a dangling kernel pointer.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 9.3 CRITICAL
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Attacker must be inside a KVM guest (AV:L, PR:L), win a multi-context race on host kernel state (AC:H), and the UAF crosses guest-to-host (S:C) with full host C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE 7.8 HIGH
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
9.3 (CRITICAL)
Patch available
Jun 09, 2026 - 14:01 EUVD
CVE Published
Jun 09, 2026 - 11:52 cve.org
CRITICAL 9.3
CVE Published
Jun 09, 2026 - 11:52 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase().

The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it.

xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.

Executive ViewAI

Why It Matters

A critical-rated Linux kernel vulnerability (CVE-2026-46316) affects organizations running Linux 6.10+ with KVM virtualization enabled. Despite the CVSS 9.3 rating, real-world exploitation probability is extremely low (0.02% EPSS), no public exploit exists, and a vendor patch is available. Remediation requires scheduled kernel updates but is not an emergency incident.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46323 HIGH
7.8
CVE-2026-46320 HIGH
7.4
CVE-2026-46322 HIGH
7.1
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46332 HIGH
8.0
CVE-2026-46321 HIGH
7.1
CVE-2026-46328 HIGH
7.3
CVE-2026-52907 HIGH
7.8
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same weakness CWE-911 – Improper Update of Reference Count

View all
CVE-2022-29581 HIGH POC
7.8
CVE-2026-49419 HIGH
8.8
CVE-2026-46099 HIGH
8.1
CVE-2026-52943 HIGH
7.8
CVE-2024-46972 HIGH
7.8
CVE-2023-5633 HIGH
7.8
CVE-2026-77587 HIGH
7.5
CVE-2023-22394 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Micro 6.2 Fixed
openSUSE Tumbleweed Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46316 ADVISORY https://seclists.org/oss-sec/2026/q2/877 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/369524 REF https://access.redhat.com/errata/RHSA-2026:34911 REF https://access.redhat.com/errata/RHSA-2026:36018 REF https://access.redhat.com/errata/RHSA-2026:38902 REF https://access.redhat.com/errata/RHSA-2026:39371 REF https://access.redhat.com/errata/RHSA-2026:40764 REF https://access.redhat.com/errata/RHSA-2026:40779 REF https://access.redhat.com/errata/RHSA-2026:40787 REF https://access.redhat.com/errata/RHSA-2026:44231 REF https://access.redhat.com/security/cve/CVE-2026-46316 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486982 REF https://git.kernel.org/stable/c/13031fb6b8357fbbcded2a7f4cba73e4781ee594 REF https://git.kernel.org/stable/c/2bbc395e81bd29c543a0529a678327e932a7ec69 REF https://git.kernel.org/stable/c/9121f4605ab94969f62d1b5714ca3c6c69bd202f REF https://git.kernel.org/stable/c/b7b72e88046328c9fdc638fe887d4240257dd5dc REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46316.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy