Linux KVM/arm64 Vulnerability Lets Attackers Escape Virtual Machines and Gain Host Access
CVE-2026-89775 lets a malicious ARM64 KVM guest skip TLB invalidation and access host memory.
Hyunwoo Kim disclosed CVE-2026-89775, a Linux KVM/arm64 flaw in stage-1 page-table walks when nested virtualization is enabled. A size calculation can return 0, which VNCR pseudo-TLB logic treats as valid, skipping invalidation and leaving a freed host page writable at a fixed kernel address. A malicious guest can then read and write that page without a VM exit, breaking cloud isolation or, where /dev/kvm is mode 0666, escalating locally to root. The code was introduced on May 14, 2025 and fixed upstream on August 6, 2026 by commit 8053393680d4.
68