CVE-2026-89775: Guest-to-Host Escape in KVM/arm64
Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.
Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.
- Type truncation of the stage-1 walk level makes size computation return 0 ('size unknown')
- VNCR pseudo-TLB invalidation path treats the 0 as a valid level
- Escape requires nested virtualization enabled on the ARM64 host
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89775 | Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposure CVE-2026-89775 is a flaw in the Linux kernel's KVM implementation for arm64, where the helper pgshift_level_to_ttl() mishandles negative walk levels when computing the size covered by a stage-1 TLB invalidation on the VNCR (nested virtualization) path. When a guest's stage-1 MMU is off, the level is encoded as the special value -127 (S1_MMU_DISABLED), but this is cast to a u8 and truncated to its bottom two bits, producing an invalidation size of 0 so stale TLB entries survive an operation that should have removed them. On a hypervisor, stale translations can allow memory mappings to outlive the pages they refer to, potentially letting a local attacker or guest read or corrupt memory across the trust boundary, consistent with the critical 9.3 CVSS (local attack, scope change, high confidentiality/integrity/availability impact). Only arm64 Linux systems running KVM with the nested-virtualization (VNCR/FEAT_NV2) code paths are affected; the advisory does not specify concrete affected or fixed version numbers. No public proof-of-concept, CISA KEV listing, or known exploitation has been reported. Do: Install a kernel update containing the upstream fix "KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation" from your vendor's stable tree once available. As an interim mitigation, do not enable nested virtualization (FEAT_NV2/NV2) for KVM guests on arm64 hosts. If you operate KVM guests on arm64, confirm whether your running kernel includes the fix by checking the package changelog or git history for this commit. | 9.3 | — |
| nichelikely well under ~10,000 ARM64 KVM hosts with nested virtualization enabled |
Posted by Hyunwoo Kim on Sep 16 Hi, The embargo agreed with the maintainers of linux-distros () vs openwall org has expired, so I am posting this report. CVE-2026-89775 is a guest-to-host escape in KVM/arm64 on hosts where nested virtualization is enabled. The root cause is a type truncation of the stage-1 walk level, which makes the size computation return 0, the value that means "size unknown". The VNCR pseudo-TLB invalidation path interprets that 0 as a valid...
This source does not provide full text. Read it at seclists.org.