New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

Summary

A critical vulnerability, CVE-2026-89775, has been discovered in the Linux kernel's KVM virtualization code for ARM64 processors. This flaw enables a guest virtual machine with nested virtualization enabled to read and write host kernel memory, potentially leading to a guest escape and execution of code on the host. The vulnerability is present in specific versions of the Linux kernel and has been fixed in newer releases, though distribution-specific patching schedules vary.

Full text

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory Swati KhandelwalSep 22, 2026Vulnerability / Virtualization A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine. The affected code is part of the mainline Linux kernel for ARM64, and it is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Nested virtualization allows a guest to run its own hypervisor, enabling it to host virtual machines. On ARM64, it is off by default. It is an experimental boot-time mode that needs Armv8.4 hardware with a feature called FEAT_NV2, so a plain ARM64 KVM host that never turns it on is outside the reported attack path. The flaw sits in the part of KVM that handles nested virtualization on ARM64. When a guest arranges its memory in a certain way, a size calculation comes out as zero, and a step that should clear stale entries from the processor's address cache, a TLB invalidation, is skipped. A page of host memory that has been freed then stays mapped and writable, and the guest can read and write it 64 bits at a time, with no hardware trap to hand control back to the host. Hyunwoo Kim, the security researcher who reported the flaw and disclosed it on September 16, says a guest can use this to escape to the host, breaking out of its own virtual machine to run code on the underlying machine. No exploit code has been published, and there is no sign the flaw has been used in an attack. The kernel's own record lists the affected code as present from Linux 6.16. But the author tagged the fix against a later change, and the maintainer who reviewed and tested it said the "missed invalidation only starts at v6.17." By that account, a host on 6.16 carries the code but not the behavior an attacker needs. There is a second way to abuse the flaw. On systems where any user can open /dev/kvm, the device a program uses to create a virtual machine, a local user could build a guest and use the same bug to gain root, Kim says. He points to Red Hat Enterprise Linux, where that device is open to all users by default. Red Hat lists its version 10 kernel as affected and versions 6 through 9 as not affected. This path still needs the host to have nested virtualization enabled. Which Kernels Are Fixed Upstream, the flaw is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Distributions are shipping the fix on their own schedules, and status differs by release. Kernel or distribution Status as of September 22 Mainline Linux Fixed in 6.18.51, 7.2.5, and 7.3-rc1 Red Hat Enterprise Linux Version 10 kernel affected; versions 6 through 9 not affected Ubuntu 26.04, including its AWS, Azure, and GCP kernels, vulnerable; 24.04 LTS general kernel not affected, though its newer hardware-enablement kernels (6.17, 7.0) are vulnerable Amazon Linux AL2023 kernel6.18 package: fix pending; other Amazon Linux kernels not affected Debian bookworm and trixie not affected (code not present); sid fixed in 7.2.6-1; forky vulnerable For hosts that cannot yet be patched, Red Hat says no mitigation meets its criteria for a workaround. The one certain thing is scope: the attack only targets hosts with nested virtualization enabled, which is not the default on ARM64. Vendors score the flaw from 7.8 to 9.3 out of 10. They agree the impact is high and the attack is local, meaning it cannot be launched over a network. The spread reflects how difficult each vendor thinks the flaw is to exploit, and Ubuntu, which shows the 9.3 figure, sets its own priority to medium. As of September 22, the flaw was not in the U.S. CISA catalog of exploited vulnerabilities, and its predicted exploitation score was below 1%. The disclosure raises the question of whether cloud tenants could use the flaw to break into a provider's machines. On the largest providers, the configuration it needs is not on offer: Amazon Web Services lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from it. That is not a clean bill of health for those platforms, but the specific path this flaw takes is not exposed in their standard ARM offerings. CVE-2026-89775 is the fourth KVM guest-to-host escape Kim has disclosed this year. Two were in the x86 version of KVM: Januscape in July and Zapscape in August. The one it most resembles is ITScape, an ARM64 KVM escape he published in June, which he called the first such escape shown publicly on ARM64. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, linux, Virtualization Security, Vulnerability ⚡ Top Stories This Week Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It. How to Evaluate a Unified Security Platform Using a One-Incident Test Stop Trying to Control AI Behavior. Control What AI Can Reach ⭐ Featured Resources Validation Summit ’26: See How Pen Testing, Exposure Validation and BAS Work Together Red Teams: Learn How Attack Path Chaining Changes Automated Security Testing Turn Threat Intelligence Into Verified Risk With Threat-Led Penetration Testing Deploy Browser Security Monitoring in Minutes With a Single Header

Indicators of Compromise

• cve — CVE-2026-89775

Entities