A newly disclosed vulnerability in the Linux kernel’s KVM virtualization code for ARM64 processors could allow a guest virtual machine to access host memory under specific configurations. Tracked as CVE-2026-89775, the flaw affects systems where ARM64 KVM hosts have nested virtualization enabled, potentially allowing a guest to read and write host kernel memory. Security researcher Hyunwoo Kim, who discovered and disclosed the issue on September 16, reported that the vulnerability could be used to escape from a guest environment and execute code on the underlying host machine. However, no public exploit code has been released and there is currently no evidence that the vulnerability has been used in real world attacks. The issue has been addressed in updated Linux kernel releases, including Linux 6.18.51, 7.2.5, and 7.3-rc1.
The vulnerability exists within the portion of KVM responsible for managing nested virtualization on ARM64 systems. Nested virtualization allows a virtual machine running on a host system to operate its own hypervisor and create additional virtual machines. On ARM64 platforms, this capability is disabled by default and requires specific hardware support, including Armv8.4 processors with the FEAT_NV2 feature. According to the technical analysis, the flaw occurs when a guest configures memory in a specific way that causes a size calculation to return zero. This prevents a required TLB invalidation step from occurring, leaving previously freed host memory mapped and writable. As a result, the guest may gain the ability to read and modify host memory without triggering a hardware exception that would normally return control to the host. The vulnerability affects code present in the mainline Linux kernel, although researchers and maintainers noted that the behavior required for exploitation appears to begin from Linux 6.17 rather than earlier versions where related code was present.
The security issue primarily impacts environments that have enabled ARM64 nested virtualization, meaning standard ARM64 KVM hosts that do not use this feature are outside the reported attack path. Kim also identified another potential abuse scenario on systems where regular users can access the /dev/kvm device, which allows programs to create virtual machines. In such environments, a local user could potentially create a guest machine and attempt to leverage the vulnerability to gain elevated privileges on the host. Red Hat has identified its Enterprise Linux 10 kernel as affected, while versions 6 through 9 are not affected. Other Linux distributions have provided their own assessments, with Ubuntu reporting that version 26.04 and certain newer hardware enablement kernels are vulnerable, while Amazon Linux and Debian have issued separate status updates based on their respective kernel packages. Vendors have assigned severity ratings ranging from 7.8 to 9.3 out of 10, reflecting the high potential impact but also the requirement for local access and specific system configurations.
For systems that cannot immediately apply security updates, Red Hat has stated that no workaround currently meets its criteria for mitigation. Administrators should evaluate whether nested virtualization is enabled and apply vendor provided patches when available. As of September 22, CVE-2026-89775 was not included in the U.S. Cybersecurity and Infrastructure Security Agency’s catalog of exploited vulnerabilities, and its predicted exploitation likelihood remained low. The disclosure has also raised questions about possible cloud environment risks, although major cloud platforms have configuration limitations that reduce exposure to this specific issue. Amazon Web Services currently lists Intel based instances for nested virtualization support, while Google Cloud does not enable nested virtualization on its ARM virtual machines. This does not represent a complete security assessment of cloud platforms, but the particular attack path described for this vulnerability is not available through their standard ARM offerings. CVE-2026-89775 is the fourth KVM guest-to-host escape vulnerability disclosed by Kim this year, following earlier research involving x86 KVM issues and the ARM64 KVM escape known as ITScape. These findings highlight continued security attention around virtualization technologies as organizations increasingly rely on virtualized infrastructure for computing workloads.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
