Linux Flaw Exposes Host Memory to ARM64 KVM Guests

"missed invalidation only starts at v6.17." — the maintainer who reviewed and tested the fix.

How CVE-2026-89775 lets an ARM64 guest touch host memory

Security researcher Hyunwoo Kim disclosed CVE-2026-89775 on September 16, describing a flaw in the Linux kernel's KVM nested-virtualization code for ARM64. The bug can leave a freed page of host memory mapped and writable inside a guest. In practical terms, a guest can read and write that host memory 64 bits at a time, with no hardware trap to return control to the host. Kim says a guest can use this to escape to the host, "breaking out of its own virtual machine to run code on the underlying machine." No exploit code has been published, and there is no sign the flaw has been used in an attack.

The technical root: a skipped TLB invalidation in nested virtualization

The flaw sits in the ARM64 implementation of nested virtualization inside KVM. When a guest arranges memory in a particular way, a size calculation evaluates to zero and the step that should clear stale entries from the processor's address cache — a TLB invalidation — is skipped. The result: a host page that has been freed can remain mapped and writable from the guest's point of view. Because nested virtualization on ARM64 permits a guest to run its own hypervisor, the bug enables an escape path when the experimental nested mode is enabled.

Which kernels are affected and where fixes appear

Upstream fixes are available in Linux 6.18.51, 7.2.5, and 7.3-rc1. The kernel's record lists the affected code as present from Linux 6.16, but the maintainer who reviewed and tested the change said the behavior that allows the exploit "only starts at v6.17." By that account, a host running 6.16 carries the code but not the exploitable behavior Kim describes. Distributions are shipping fixes on their own schedules, and status differs by release.

Red Hat, /dev/kvm, and the local-privilege path

Kim also pointed out a second abuse path: on systems where any user can open /dev/kvm, a local user could build a guest and use the same bug to gain root. Red Hat Enterprise Linux configures that device to be open to all users by default; Red Hat lists its version 10 kernel as affected and versions 6 through 9 as not affected. Red Hat told users that, for hosts that cannot yet be patched, "no mitigation meets its criteria for a workaround." The one certain limiter is scope: the attack targets hosts with nested virtualization enabled, and nested virtualization is an experimental boot-time mode that is off by default on ARM64.

Cloud exposure: AWS, Google Cloud, and the practical attack surface

Whether cloud tenants could weaponize this flaw against providers depends on platform configurations. On the largest providers, the specific nested-virtualization configuration the bug needs is not offered for ARM instances: Amazon Web Services lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from nested virtualization. That does not constitute a universal clean bill of health for cloud platforms, but it does mean the precise attack path described is not present in those providers' standard ARM offerings.

Scoring, context, and what comes next for defenders

Vendors' severity scores for CVE-2026-89775 range from 7.8 to 9.3 out of 10; Ubuntu shows the 9.3 figure and sets its own priority to medium. As of September 22, the flaw was not listed in the U.S. CISA catalog of exploited vulnerabilities and carried a predicted exploitation score below 1%. This is the fourth KVM guest-to-host escape Hyunwoo Kim has disclosed in 2026 — following Januscape (July), Zapscape (August) on x86, and ITScape (June) on ARM64 — underscoring a pattern of researcher attention on KVM attack surfaces across architectures.

For hosts that cannot immediately apply the upstream fixes, the effective mitigations are narrow: ensure nested virtualization is not enabled unless you require it, and follow vendor advisories and distribution updates closely. Red Hat has indicated the necessity of a patch rather than a configuration workaround for affected releases.

One concrete question the record leaves is timing: distributions will ship the upstream fixes "on their own schedules," and defenders must reconcile mixed version notes (code present from 6.16 vs. behavior starting at 6.17) with their installed kernels. For now, the combination of the bug's requirement for experimental nested mode and the absence of published exploits keeps the practical risk contained for most ARM64 hosts — but not for any environment that deliberately enables nested virtualization or exposes /dev/kvm to unprivileged users.

Original reporting: https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html