New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
Linux kernel flaw CVE-2026-89775 lets ARM64 KVM guests read and write freed host memory, enabling guest-to-host escape.
Researcher Hyunwoo Kim disclosed CVE-2026-89775 in the Linux kernel's ARM64 KVM nested virtualization code, which skips a TLB invalidation and leaves freed host memory readable and writable by a guest, enabling escape to the host. The attack is local-only and requires nested virtualization (off by default, needing Armv8.4 FEAT_NV2 hardware); vendors score it 7.8-9.3. Fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1, with RHEL 10 and Ubuntu 26.04 affected; Red Hat offers no workaround. No exploit has been published and no attacks have been observed; it is the fourth KVM guest-to-host escape Kim disclosed this year after Januscape, Zapscape, and ITScape.