Linux Kernel Vulnerability
A new Linux kernel vulnerability in the KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine. This Linux kernel vulnerability is a significant concern for organizations relying on virtualization for their infrastructure. According to the source URL Thehackernews, the vulnerability is a result of a size calculation error, which leads to a skipped TLB invalidation, allowing a page of host memory to remain mapped and writable.
Technical Details of the Linux Kernel Vulnerability
The affected code is part of the mainline Linux kernel for ARM64, and it is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Nested virtualization allows a guest to run its own hypervisor, enabling it to host virtual machines. On ARM64, it is off by default. It is an experimental boot-time mode that needs Armv8.4 hardware with a feature called FEAT_NV2, so a plain ARM64 KVM host that never turns it on is outside the reported attack path. The vulnerability is a result of a size calculation error, which leads to a skipped TLB invalidation, allowing a page of host memory to remain mapped and writable. This error can be exploited by a malicious guest to access and modify sensitive host memory, potentially leading to a complete compromise of the host system.
Impact of the Linux Kernel Vulnerability
The Linux kernel vulnerability sits in the part of KVM that handles nested virtualization on ARM64. When a guest arranges its memory in a certain way, a size calculation comes out as zero, and a step that should clear stale entries from the processor's address cache, a TLB invalidation, is skipped. A page of host memory that has been freed then stays mapped and writable, and the guest can read and write it 64 bits at a time, with no hardware trap to hand control back to the host. This vulnerability can be used to escape the guest and run code on the host machine, potentially leading to a complete compromise of the host system. Organizations that rely on virtualization for their infrastructure are at risk, particularly those that use ARM64-based systems. Cloud providers that offer virtual machines with nested virtualization enabled are also at risk, as a malicious guest could potentially use this vulnerability to escape and access sensitive host memory.
Exploitation and Mitigation
Hyunwoo Kim, the security researcher who reported the flaw and disclosed it on September 16, says a guest can use this to escape to the host, breaking out of its own virtual machine to run code on the underlying machine. No exploit code has been published, and there is no sign the flaw has been used in an attack. For hosts that cannot yet be patched, Red Hat says no mitigation meets its criteria for a workaround. The one certain thing is scope: the attack only targets hosts with nested virtualization enabled, which is not the default on ARM64. Organizations should prioritize patching their systems and implementing additional security measures to prevent exploitation. Users can check the vulnerability status of a specific Linux kernel version by visiting the NIST vulnerability database.
Affected Kernels and Distributions
The kernel's own record lists the affected code as present from Linux 6.16. But the author tagged the fix against a later change, and the maintainer who reviewed and tested it said the "missed invalidation only starts at v6.17." By that account, a host on 6.16 carries the code but not the behavior an attacker needs. Upstream, the flaw is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Distributions are shipping the fix on their own schedules, and status differs by release. Organizations should check with their distribution vendors to determine the status of the fix and apply it as soon as possible.
Vendor Scores and Exploitation Predictions
Vendors score the flaw from 7.8 to 9.3 out of 10. They agree the impact is high and the attack is local, meaning it cannot be launched over a network. The spread reflects how difficult each vendor thinks the flaw is to exploit, and Ubuntu, which shows the 9.3 figure, sets its own priority to medium. As of September 22, the flaw was not in the U.S. CISA catalog of exploited vulnerabilities, and its predicted exploitation score was below 1%. This suggests that while the vulnerability is significant, it may not be easily exploitable, and organizations have a window of opportunity to patch their systems before attackers can develop effective exploits.
Cloud Provider Implications
The disclosure raises the question of whether cloud tenants could use the flaw to break into a provider's machines. On the largest providers, the configuration it needs is not on offer: Amazon Web Services lists only Intel-based instances for nested virtualization, and Google Cloud excludes its ARM virtual machines from it. That is not a clean bill of health for those platforms, but the specific path this flaw takes is not exposed in their standard ARM offerings. Cloud providers should still take this vulnerability seriously and ensure their systems are patched and secure, as the flaw could potentially be used to compromise the underlying infrastructure. Cloud providers should also consider implementing additional security measures, such as monitoring for suspicious activity and implementing network segmentation, to prevent exploitation.
Related Vulnerabilities and Exploits
CVE-2026-89775 is the fourth KVM guest-to-host escape Hyunwoo Kim has disclosed this year. Two were in the x86 version of KVM: Januscape in July and Zapscape in August. The one it most resembles is ITScape, an ARM64 KVM escape he published in June, which he called the first such escape shown publicly on ARM64. The fact that multiple vulnerabilities have been discovered in the KVM codebase highlights the need for ongoing security research and testing to identify and address potential flaws before they can be exploited. Users can find more information on Linux kernel vulnerabilities and their impact on virtualization security by reviewing the Linux kernel vulnerability reports and security advisories.
Vulnerability Mitigation Steps
The Linux kernel vulnerability disclosed in this article is a significant concern for organizations relying on virtualization for their infrastructure. The flaw allows ARM64 KVM guests to read and write host kernel memory, potentially leading to a complete compromise of the host system. Cloud providers should also take this vulnerability seriously and ensure their systems are patched and secure. By taking proactive steps to address this vulnerability, organizations can help protect their infrastructure and prevent potential attacks. Organizations should also consider implementing a comprehensive security strategy that includes regular security audits, penetration testing, and incident response planning to ensure they are prepared to respond to potential security incidents.
Related coverage
- Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation
- Orkes Conductor CVE-2026-58138: Critical Pre-Auth RCE Actively Exploited
- Linux Kernel Local Root Exploit: Public Exploits Released for Four Vulnerabilities