CVE-2026-89775: Guest-to-Host Escape in KVM/arm64
Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.
Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.
- Type truncation of the stage-1 walk level makes size computation return 0 ('size unknown')
- VNCR pseudo-TLB invalidation path treats the 0 as a valid level
- Escape requires nested virtualization enabled on the ARM64 host
- CVEs
- CVE-2026-89775
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89775 | Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposure | 9.3 | — |
From the original article
Posted by Hyunwoo Kim on Sep 16 Hi, The embargo agreed with the maintainers of linux-distros () vs openwall org has expired, so I am posting this report. CVE-2026-89775 is a guest-to-host escape in KVM/arm64 on hosts where nested virtualization is enabled. The root cause is a type truncation of the stage-1 walk level, which makes the size computation return 0, the value that means "size unknown".
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.