Linux Kernel Flaw Gives ARM64 KVM Guests Access to Host Memory

A flaw in the Linux kernel's KVM code for ARM64 processors leaves a freed page of host memory exposed to a guest virtual machine. The bug, tracked as CVE-2026-89775, lets a guest read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the underlying machine.

Where the bug lives

The flaw sits in the part of KVM that handles nested virtualization — the mode in which a guest runs its own hypervisor and can host virtual machines of its own. On ARM64 this mode is off by default: it is an experimental boot-time option that needs Armv8.4 hardware with a feature called FEAT_NV2. A plain ARM64 KVM host that never turns it on is outside the reported attack path.

When a guest arranges its memory in a certain way, a size calculation comes out as zero, and a step that should clear stale entries from the processor's address cache — a TLB invalidation — is skipped. A freed page of host memory stays mapped and writable, and the guest can read and write it 64 bits at a time, with no hardware trap to hand control back to the host.

Hyunwoo Kim, who reported the flaw and disclosed it on September 16, says no exploit code has been published and there is no sign of attacks. Kernel records list the affected code as present from Linux 6.16, but the maintainer who reviewed the fix noted that the "missed invalidation only starts at v6.17."

A second path, and the reach

There is another way to abuse the bug. On systems where any user can open /dev/kvm, a local user could build a guest and use the same flaw to gain root. Kim points to Red Hat Enterprise Linux, where that device is open to all users by default; its version 10 kernel is listed as affected, while versions 6 through 9 are not. This path still requires nested virtualization to be enabled.

Upstream, the flaw is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1, with distributions shipping on their own schedules. Ubuntu 26.04 and Debian's sid branch are among the vulnerable. Red Hat says no mitigation meets its criteria for a workaround.

Severity scores diverge: vendors rate the flaw from 7.8 to 9.3 out of 10, agreeing the impact is high and the attack is local, meaning it cannot be launched over a network. As of September 22 the flaw was not in the U.S. CISA catalog of exploited vulnerabilities.

Could cloud tenants break into a provider's machines? The largest platforms simply do not offer the needed configuration: AWS lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from it.

CVE-2026-89775 is the fourth KVM guest-to-host escape Kim has disclosed this year, and it most resembles ITScape — the first such escape shown publicly on ARM64, which he published in June.

Source: The Hacker News