Critical Linux KVM Flaw Enables Guest-to-Host Escape on ARM64 Systems
A Linux KVM bug on ARM64 with nested virtualization can let a guest read and write host kernel memory.
CVE-2026-89775 is a Linux KVM/arm64 bug that can give a malicious guest read and write access to a freed host kernel page when nested virtualization is enabled. A type truncation makes VNCR pseudo-TLB invalidation skip a range, leaving a stale writable mapping that the guest can access at a fixed address without a VM exit. The bug was introduced in May 2025 and fixed upstream on August 6, 2026. Systems without KVM/arm64 nested virtualization are not affected by this path, and some distributions expose world-writable /dev/kvm.
- Nested ARM64 guests can retain a writable mapping to a freed host page.
- Guest reads and writes occur at a fixed address without a VM exit.
- Vulnerable code landed in May 2025 and was fixed upstream in August 2026.
- Turn off nested virtualization and limit /dev/kvm access until patched.
- CVEs
- CVE-2026-89775
- Vendors
- Red Hat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89775 | Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposure | 9.3 | — |
From the original article
2 min read at gbhackers.com
A critical vulnerability in the Linux Kernel-based Virtual Machine (KVM) for ARM64 systems could let attackers escape a virtual machine and gain read and write access to host kernel memory. This flaw, tracked as CVE-2026-89775, specifically affects ARM64 hosts with nested virtualization enabled and has been addressed in the mainline Linux kernel. Security researcher Hyunwoo […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.