A new flaw in the Linux kernel’s KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled.
The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine.
The affected code is part of the mainline Linux kernel for ARM64, and it is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1.
Nested virtualization allows a guest to run its own hypervisor, enabling it to host virtual machines. On ARM64, it is off by default. It is an experimental boot-time mode that needs Armv8.4 hardware with a feature called FEAT_NV2, so a plain ARM64 KVM host that never turns it on is outside the reported attack path.
The flaw sits in the part of KVM that handles nested virtualization on ARM64. When a guest arranges its memory in a certain way, a size calculation comes out as zero, and a step that should clear stale entries from the processor’s address cache, a TLB invalidation, is skipped.
A page of host memory that has been freed then stays mapped and writable, and the guest can read and write it 64 bits at a time, with no hardware trap to hand control back to the host.
Hyunwoo Kim, the security researcher who reported the flaw and disclosed it on September 16, says a guest can use this to escape to the host, breaking out of its own virtual machine to run code on the underlying machine. No exploit code has been published, and there is no sign the flaw has been used in an attack.
The kernel’s own record lists the affected code as present from Linux 6.16. But the author tagged the fix against a later change, and the maintainer who reviewed and tested it said the “missed invalidation only starts at v6.17.” By that account, a host on 6.16 carries the code but not the behavior an attacker needs.
There is a second way to abuse the flaw. On systems where any user can open /dev/kvm, the device a program uses to create a virtual machine, a local user could build a guest and use the same bug to gain root, Kim says.
He points to Red Hat Enterprise Linux, where that device is open to all users by default. Red Hat lists its version 10 kernel as affected and versions 6 through 9 as not affected. This path still needs the host to have nested virtualization enabled.
Which Kernels Are Fixed
Upstream, the flaw is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Distributions are shipping the fix on their own schedules, and status differs by release.
| Kernel or distribution | Status as of September 22 |
|---|---|
| Mainline Linux | Fixed in 6.18.51, 7.2.5, and 7.3-rc1 |
|
Red Hat Enterprise Linux |
Version 10 kernel affected; versions 6 through 9 not affected |
|
Ubuntu |
26.04, including its AWS, Azure, and GCP kernels, vulnerable; 24.04 LTS general kernel not affected, though its newer hardware-enablement kernels (6.17, 7.0) are vulnerable |
|
Amazon Linux |
AL2023 kernel6.18 package: fix pending; other Amazon Linux kernels not affected |
|
Debian |
bookworm and trixie not affected (code not present); sid fixed in 7.2.6-1; forky vulnerable |
For hosts that cannot yet be patched, Red Hat says no mitigation meets its criteria for a workaround. The one certain thing is scope: the attack only targets hosts with nested virtualization enabled, which is not the default on ARM64.
Vendors score the flaw from 7.8 to 9.3 out of 10. They agree the impact is high and the attack is local, meaning it cannot be launched over a network. The spread reflects how difficult each vendor thinks the flaw is to exploit, and Ubuntu, which shows the 9.3 figure, sets its own priority to medium.
As of September 22, the flaw was not in the U.S. CISA catalog of exploited vulnerabilities, and its predicted exploitation score was below 1%.
The disclosure raises the question of whether cloud tenants could use the flaw to break into a provider’s machines. On the largest providers, the configuration it needs is not on offer: Amazon Web Services lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from it.
That is not a clean bill of health for those platforms, but the specific path this flaw takes is not exposed in their standard ARM offerings.
CVE-2026-89775 is the fourth KVM guest-to-host escape Kim has disclosed this year. Two were in the x86 version of KVM: Januscape in July and Zapscape in August. The one it most resembles is ITScape, an ARM64 KVM escape he published in June, which he called the first such escape shown publicly on ARM64.
