Security Advisories
This section documents security issues that affect VirtFusion hypervisors, with patch status for the Linux distributions VirtFusion supports (Debian 12/13, Ubuntu 22.04/24.04, AlmaLinux 9/10, and Rocky Linux 9/10). Each advisory explains what the issue is, whether your hosts are affected, how to patch, and how to mitigate in the meantime.
The KVM Escape Trilogy
During 2026, security researcher Hyunwoo Kim (V4bel) disclosed three related VM-to-host escape vulnerabilities in KVM, collectively called "The KVM Escape Trilogy". All three can affect VirtFusion hypervisors, split by CPU architecture:
- Januscape (CVE-2026-53359): x86 (Intel and AMD). A use-after-free in the KVM shadow MMU, present since 2010.
- Zapscape (CVE-2026-64561): x86 (AMD, and Intel under a specific EPT condition). A use-after-free in the KVM shadow MMU.
- ITScape (CVE-2026-46316): arm64 only. A double-free use-after-free in KVM's vGIC-ITS emulation. VirtFusion runs arm64 hypervisors on Debian 12/13, AlmaLinux 9/10, and Rocky Linux 9/10. Debian 12 is not affected (the flaw was introduced after its kernel branched); Debian 13, AlmaLinux, and Rocky Linux are affected and fixed (with one gap: Rocky Linux 10 has no ITScape-specific erratum yet).
Which advisories apply to a given hypervisor depends on its CPU: x86_64 hosts are exposed to Januscape and Zapscape, while arm64 hosts are exposed to ITScape.
Timeline
Each event below is dated from the upstream commit, the public disclosure, or the vendor advisory. AlmaLinux and Rocky Linux ship the same kernel builds but publish separate advisories on separate dates. As of 2026-08-24, a few gaps remain: Ubuntu 22.04 and 24.04 are fixed for Januscape but not yet for Zapscape; Debian 12's default 6.1 kernel is not yet patched for Zapscape (its linux-6.12 backport is); and Rocky Linux 10 still has no ITScape erratum (see the ITScape advisory).
| Date | Event |
|---|---|
| 2010-08-01 | Januscape flaw introduced in KVM/x86 (roughly 16 years before disclosure) |
| 2024-04-25 | ITScape flaw introduced in KVM/arm64 |
| 2026-06-05 | ITScape fixed in the mainline Linux kernel (CVE-2026-46316) |
| 2026-06-10 | ITScape publicly disclosed |
| 2026-06-16 | Januscape fixed in the mainline Linux kernel (CVE-2026-53359) |
| 2026-06-21 | Debian ships the ITScape fix (DSA-6355-1, trixie 6.12.94-1) |
| 2026-07-02 | AlmaLinux 10 ships the ITScape fix (ALSA-2026:34911) |
| 2026-07-05 | Debian ships the Januscape fix (DSA-6381-1, bookworm 6.1.180-1 / trixie 6.12.95-1) |
| 2026-07-06 | Januscape publicly disclosed; AlmaLinux 9 ships the ITScape fix (ALSA-2026:36018) |
| 2026-07-09 | AlmaLinux ships the Januscape fix (ALSA-2026:36957 for 9, ALSA-2026:36956 for 10) |
| 2026-07-11 | Rocky Linux 9 ships the ITScape fix (RLSA-2026:36018); Rocky Linux 10 ships the Januscape fix (RLSA-2026:36956) |
| 2026-07-13 | Rocky Linux 9 ships the Januscape fix (RLSA-2026:36957) |
| 2026-07-21 | Zapscape fixed in the mainline Linux kernel (CVE-2026-64561) |
| 2026-07-24 | AlmaLinux ships the Zapscape fix (ALSA-2026:45192 for 9, ALSA-2026:45114 for 10) |
| 2026-07-27 | Rocky Linux ships the Zapscape fix (RLSA-2026:45192 for 9, RLSA-2026:45114 for 10) |
| 2026-08-04 | Zapscape publicly disclosed |
| 2026-08-06 | Debian ships the Zapscape fix (DSA-6415-1, trixie 6.12.101-1) |
What to do
In every case the fix is the same: patch the host kernel and reboot. See the per-distribution fixed versions in each advisory. The interim options differ by architecture:
- x86_64 hosts (Januscape, Zapscape): if a fixed kernel is not yet available, disable nested virtualization as an interim mitigation. The full procedure is in each advisory.
- arm64 hosts (ITScape): there is no practical mitigation short of patching, so affected hosts (Debian 13, AlmaLinux 9/10, and Rocky Linux 9/10) should be updated as a priority.
Start with the advisory for the issue you are checking:
- Januscape (CVE-2026-53359) (x86)
- Zapscape (CVE-2026-64561) (x86)
- ITScape (CVE-2026-46316) (arm64)