AI-generated editorial illustration; not a documentary photograph.
A vulnerability in the Linux kernel's ARM64 KVM virtualization code can let a guest virtual machine read and write host kernel memory when nested virtualization is enabled. Tracked as CVE-2026-89775, the flaw can support a guest escape and host code execution, according to security researcher Hyunwoo Kim. No exploit code has been published, and there is no reported evidence of attacks using it.
Why the flaw matters
The affected path handles ARM64 nested virtualization, a mode that allows a guest to run its own hypervisor and create further virtual machines. A particular guest memory arrangement can produce a zero size calculation, causing KVM to skip a required translation lookaside buffer invalidation. A freed host-memory page may then remain mapped and writable, allowing the guest to access it in 64-bit units without triggering a hardware trap.
The reported attack is local rather than network-based. On systems where users can open /dev/kvm, a local user could create a guest and use the same flaw to obtain root access, provided nested virtualization is enabled. Kim identified Red Hat Enterprise Linux 10 as affected, while Red Hat lists versions 6 through 9 as unaffected.
Scope and fixed releases
ARM64 nested virtualization is disabled by default and requires experimental boot-time support on Armv8.4 hardware with FEAT_NV2. A standard ARM64 KVM host that has never enabled the mode is outside the reported attack path. The vulnerability therefore does not affect every ARM64 Linux virtualization deployment.
Upstream fixes are included in Linux 6.18.51, 7.2.5 and 7.3-rc1. Distribution updates are arriving on separate schedules. The kernel record associates the code with Linux 6.16, but the fix review says the exploitable missed-invalidation behavior begins in 6.17, leaving an attribution difference in the affected-version history.
Cloud and mitigation limits
The specific configuration is not offered in the standard ARM instances described for Amazon Web Services and Google Cloud: AWS lists nested virtualization only for Intel-based instances, while Google Cloud excludes its ARM virtual machines. That narrows the reported exposure for those offerings but is not a general security assurance for their platforms.
For systems that cannot yet be patched, Red Hat says it has no workaround meeting its mitigation criteria. As of September 22, CVE-2026-89775 was not listed in the U.S. CISA catalog of exploited vulnerabilities, and its predicted exploitation score was below 1%. Vendor severity scores ranged from 7.8 to 9.3, reflecting differing exploitation assessments.
Source: New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
SIGNAL TITANS
Leave a Reply