New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
Linux kernel flaw CVE-2026-89775 lets ARM64 KVM guests read and write freed host memory, enabling guest-to-host escape.
Researcher Hyunwoo Kim disclosed CVE-2026-89775 in the Linux kernel's ARM64 KVM nested virtualization code, which skips a TLB invalidation and leaves freed host memory readable and writable by a guest, enabling escape to the host. The attack is local-only and requires nested virtualization (off by default, needing Armv8.4 FEAT_NV2 hardware); vendors score it 7.8-9.3. Fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1, with RHEL 10 and Ubuntu 26.04 affected; Red Hat offers no workaround. No exploit has been published and no attacks have been observed; it is the fourth KVM guest-to-host escape Kim disclosed this year after Januscape, Zapscape, and ITScape.
- CVE-2026-89775 lets a guest read/write host memory 64 bits at a time with no hardware trap
- Requires local access plus nested virtualization enabled on ARM64, which is not default
- Fixed in Linux 6.18.51, 7.2.5, 7.3-rc1; RHEL 10 and Ubuntu 26.04 kernels affected
- Second abuse path: local users on systems with open /dev/kvm could gain root
- Not in CISA KEV, no PoC published, predicted exploitation below 1%
Vulnerabilities mentionedAll →
- CVE-2026-897759.3—Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposurepublished · Linux kernel - KVM arm64 nested virtualization (VNCR) TLB invalidation path
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89775 | Improper TLB invalidation in Linux kernel KVM/arm64 risks cross-VM memory exposure CVE-2026-89775 is a flaw in the Linux kernel's KVM implementation for arm64, where the helper pgshift_level_to_ttl() mishandles negative walk levels when computing the size covered by a stage-1 TLB invalidation on the VNCR (nested virtualization) path. When a guest's stage-1 MMU is off, the level is encoded as the special value -127 (S1_MMU_DISABLED), but this is cast to a u8 and truncated to its bottom two bits, producing an invalidation size of 0 so stale TLB entries survive an operation that should have removed them. On a hypervisor, stale translations can allow memory mappings to outlive the pages they refer to, potentially letting a local attacker or guest read or corrupt memory across the trust boundary, consistent with the critical 9.3 CVSS (local attack, scope change, high confidentiality/integrity/availability impact). Only arm64 Linux systems running KVM with the nested-virtualization (VNCR/FEAT_NV2) code paths are affected; the advisory does not specify concrete affected or fixed version numbers. No public proof-of-concept, CISA KEV listing, or known exploitation has been reported. |
Full article833 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 22, 2026Vulnerability / Virtualization
A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled.
The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine.
The affected code is part of the mainline Linux kernel for ARM64, and it is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1.
Nested virtualization allows a guest to run its own hypervisor, enabling it to host virtual machines. On ARM64, it is off by default. It is an experimental boot-time mode that needs Armv8.4 hardware with a feature called FEAT_NV2, so a plain ARM64 KVM host that never turns it on is outside the reported attack path.
The flaw sits in the part of KVM that handles nested virtualization on ARM64. When a guest arranges its memory in a certain way, a size calculation comes out as zero, and a step that should clear stale entries from the processor's address cache, a TLB invalidation, is skipped.
A page of host memory that has been freed then stays mapped and writable, and the guest can read and write it 64 bits at a time, with no hardware trap to hand control back to the host.
Hyunwoo Kim, the security researcher who reported the flaw and disclosed it on September 16, says a guest can use this to escape to the host, breaking out of its own virtual machine to run code on the underlying machine. No exploit code has been published, and there is no sign the flaw has been used in an attack.
The kernel's own record lists the affected code as present from Linux 6.16. But the author tagged the fix against a later change, and the maintainer who reviewed and tested it said the "missed invalidation only starts at v6.17." By that account, a host on 6.16 carries the code but not the behavior an attacker needs.
There is a second way to abuse the flaw. On systems where any user can open /dev/kvm, the device a program uses to create a virtual machine, a local user could build a guest and use the same bug to gain root, Kim says.
He points to Red Hat Enterprise Linux, where that device is open to all users by default. Red Hat lists its version 10 kernel as affected and versions 6 through 9 as not affected. This path still needs the host to have nested virtualization enabled.
Which Kernels Are Fixed
Upstream, the flaw is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Distributions are shipping the fix on their own schedules, and status differs by release.
| Kernel or distribution | Status as of September 22 |
|---|---|
| Mainline Linux | Fixed in 6.18.51, 7.2.5, and 7.3-rc1 |
| Red Hat Enterprise Linux | Version 10 kernel affected; versions 6 through 9 not affected |
| Ubuntu | 26.04, including its AWS, Azure, and GCP kernels, vulnerable; 24.04 LTS general kernel not affected, though its newer hardware-enablement kernels (6.17, 7.0) are vulnerable |
| Amazon Linux | AL2023 kernel6.18 package: fix pending; other Amazon Linux kernels not affected |
| Debian | bookworm and trixie not affected (code not present); sid fixed in 7.2.6-1; forky vulnerable |
For hosts that cannot yet be patched, Red Hat says no mitigation meets its criteria for a workaround. The one certain thing is scope: the attack only targets hosts with nested virtualization enabled, which is not the default on ARM64.
Vendors score the flaw from 7.8 to 9.3 out of 10. They agree the impact is high and the attack is local, meaning it cannot be launched over a network. The spread reflects how difficult each vendor thinks the flaw is to exploit, and Ubuntu, which shows the 9.3 figure, sets its own priority to medium.
As of September 22, the flaw was not in the U.S. CISA catalog of exploited vulnerabilities, and its predicted exploitation score was below 1%.
The disclosure raises the question of whether cloud tenants could use the flaw to break into a provider's machines. On the largest providers, the configuration it needs is not on offer: Amazon Web Services lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from it.
That is not a clean bill of health for those platforms, but the specific path this flaw takes is not exposed in their standard ARM offerings.
CVE-2026-89775 is the fourth KVM guest-to-host escape Kim has disclosed this year. Two were in the x86 version of KVM: Januscape in July and Zapscape in August. The one it most resembles is ITScape, an ARM64 KVM escape he published in June, which he called the first such escape shown publicly on ARM64.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.