Linux KVM ARM64 flaw lets guests reach host memory

A newly disclosed flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed page of host memory readable and writable by a virtual machine running on the same physical machine, according to the researcher who found it. The bug is tracked as CVE-2026-89775 and is fixed in Linux 6.18.51, 7.2.5 and 7.3-rc1. KVM, which stands for Kernel-based Virtual Machine, is the part built into Linux that lets one physical computer run several separate virtual computers at once. The host is the real machine underneath; a guest is one of the virtual machines running on it. The flaw does not apply to every Linux system, and the vendors scoring it rate the impact as high while agreeing that reaching it is difficult, because it only matters where a rarely used feature called nested virtualization has been deliberately switched on.

The fault sits in the section of KVM that handles nested virtualization on ARM64, the 64-bit processor design used in many servers and cloud data centres. Nested virtualization means a guest is allowed to run its own hypervisor, the software layer that normally creates and manages virtual machines, so a guest can host virtual machines of its own. When a guest arranges its memory in a certain way, a size calculation in the kernel comes out as zero. That causes a step that should clear stale entries from the processor's translation lookaside buffer to be skipped; that buffer is a small, fast cache recording where pieces of memory currently sit. Because the clearing, known as a TLB invalidation, never happens, a page of host memory the kernel has already freed stays mapped and writable for the guest. The guest can then read and write that memory 64 bits at a time, and no hardware trap hands control back to the host while it does so.

Hyunwoo Kim, the security researcher who reported the flaw, disclosed it on September 16 and says a guest can use it to break out of its own virtual machine and run code on the underlying physical machine, an outcome known as a guest-to-host escape. That is the worst case rather than the everyday one: no exploit code has been published, and there is no sign the flaw has been used in an attack.

The limits on who is exposed matter as much as the bug itself. Nested virtualization is off by default on ARM64. It is an experimental boot-time mode that needs Armv8.4 hardware with a processor feature called FEAT_NV2, and a plain ARM64 KVM host that never turns it on is outside the reported attack path. The machines at risk, then, are those whose operators deliberately enabled the capability, usually because they want to run virtual machines inside virtual machines for testing, development or a specialised service.

There is also some disagreement about how far back the problem reaches. The kernel's own record lists the affected code as present from Linux 6.16, but the author of the fix tagged it against a later change, and the maintainer who reviewed and tested the patch said the missed invalidation only starts at v6.17. By that account, a host on 6.16 carries the code but not the behaviour an attacker needs.

Kim describes a second way to abuse the same flaw. On systems where any user is allowed to open /dev/kvm, the device file a program uses to create a virtual machine, a local user who already has an account on the machine could build a guest and use the bug to gain root, the administrator account that has full control of a Linux system. He points to Red Hat Enterprise Linux, where that device is open to all users by default. Red Hat lists its version 10 kernel as affected and versions 6 through 9 as not affected. This route still requires the host to have nested virtualization enabled.

Fixes are arriving on each vendor's own timetable. Upstream, the flaw is repaired in Linux 6.18.51, 7.2.5 and 7.3-rc1. On Ubuntu, version 26.04 is vulnerable, including its Amazon Web Services, Microsoft Azure and Google Cloud kernels, while the general 24.04 LTS kernel is not affected; Ubuntu's newer hardware-enablement kernels, 6.17 and 7.0, are vulnerable. On Amazon Linux, the AL2023 kernel6.18 package is still waiting for a fix, and other Amazon Linux kernels are not affected. Debian's bookworm and trixie releases are not affected because the code is not present, sid is fixed in 7.2.6-1, and forky is vulnerable. For hosts that cannot be patched yet, Red Hat says no mitigation meets its criteria for a workaround.

Vendors score the flaw between 7.8 and 9.3 out of 10. They agree the impact is high and that the attack is local, meaning it cannot be launched over a network and an attacker would already need a foothold on the machine. The spread reflects how difficult each vendor thinks exploitation is, and Ubuntu, which publishes the 9.3 figure, sets its own priority to medium. As of September 22, the flaw was not in the U.S. CISA catalog of exploited vulnerabilities, and its predicted exploitation score was below 1%.

The disclosure raises the obvious question of whether a cloud tenant could use the bug to break into a provider's own machines. On the largest providers, the configuration it needs is not on offer: Amazon Web Services lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from it. That is not a clean bill of health for those platforms, but the specific path this flaw takes is not exposed in their standard ARM offerings.

CVE-2026-89775 is the fourth KVM guest-to-host escape Kim has disclosed this year. Two were in the x86 version of KVM: Januscape in July and Zapscape in August. The one it most resembles is ITScape, an ARM64 KVM escape he published in June and described as the first such escape shown publicly on ARM64.

For website owners and IT teams, the practical question is whether the machines they rely on fall into the narrow group described above. Most small sites sit on shared or managed hosting where nested virtualization plays no part, but anyone running an ARM-based Linux server, a private cloud or a test lab should check the kernel version against the list above and confirm whether nested virtualization is switched on at all. Where several people share a machine, it is worth knowing whether ordinary accounts can open /dev/kvm, since that is the setup behind the second attack path. For organisations that want a structured look at how their servers and virtual machines are configured, AEU-I, the security-first IT, infrastructure and consulting service from AEU Group, describes what it covers on its own page.