Linux ARM64 KVM Flaw Enables Guest-to-Host Escape

A vulnerability in the Linux kernel’s KVM virtualization code for ARM64 processors could allow a guest virtual machine to escape its environment and execute code on the host machine.

The flaw, identified as CVE-2026-89775, affects hosts where nested virtualization is enabled. Security researcher Hyunwoo Kim discovered that the bug allows a guest to read and write host kernel memory, potentially leading to a full guest-to-host escape.

Technical Cause and Exploitation Risks

The vulnerability resides in the part of the KVM (Kernel-based Virtual Machine) code that manages nested virtualization on ARM64 hardware. When a guest organises its memory in a specific way, a size calculation error results in a zero value. This error causes the system to skip a critical step: the invalidation of the Translation Lookaside Buffer (TLB), which is responsible for clearing stale entries from the processor’s address cache.

As a result, a page of host memory that has been freed remains mapped and writable. A guest can then read and write this memory 64 bits at a time without triggering a hardware trap to the host.

Beyond virtual machine escapes, Kim identified a potential secondary exploitation path. On systems where local users can access the /dev/kvm device, such as Red Hat Enterprise Linux, a user could create a guest to exploit the flaw and gain root privileges on the host.

Affected Distributions and Patch Status

The vulnerability is fixed in mainline Linux versions 6.18.51, 7.2.5, and 7.3-rc1. However, the availability of patches varies across different Linux distributions:

• Red Hat Enterprise Linux: Version 10 is affected, while versions 6 through 9 are not.
• Ubuntu: Version 26.04, including kernels used on AWS, Azure, and GCP, is vulnerable. While the general 24.04 LTS kernel is not affected, newer hardware-enablement kernels (6.17 and 7.0) are vulnerable.
• Amazon Linux: A fix for the AL2023 kernel 6.18 package is currently pending.
• Debian: The sid release is fixed in 7.2.6-1, but forky remains vulnerable.

Cloud providers such as Amazon Web Services and Google Cloud appear to have a reduced risk profile for this specific flaw. AWS currently only offers nested virtualization for Intel-based instances, and Google Cloud excludes its ARM virtual machines from this feature.

As of 22 September 2026, there have been no reports of this flaw being exploited in the wild, and no public exploit code has been released.