A serious vulnerability has been identified in the Linux Kernel-based Virtual Machine (KVM) specifically targeting ARM64 systems, which poses a significant risk by allowing attackers to escape from a virtual machine and gain unauthorized read and write access to the host kernel memory. This issue has been classified under the common vulnerability enumeration (CVE) identifier CVE-2026-89775 and primarily affects ARM64 hosts that have nested virtualization enabled. Fortunately, the mainline Linux kernel has already addressed this flaw.
This security breach was disclosed by researcher Hyunwoo Kim following the lifting of a coordinated-disclosure embargo. The problem originates from how KVM/arm64 manages virtual CPU nested virtualization control structures, which can inadvertently leave a freed page of host memory available to a malicious virtual guest.
### Understanding the Vulnerability
The vulnerability is rooted in a type truncation problem that impacts the stage-1 page-table walk level. During the handling of address translation, this truncation leads to a size calculation erroneously returning zero— a value meant to indicate an unknown size. However, this zero value is misinterpreted by the Virtual Nested Control Register (VNCR) pseudo-Translation Lookaside Buffer (TLB) invalidation path as a valid size range. As a result, the invalidation operation may effectively skip any necessary actions, creating a stale mapping condition that forms the core of the security concern.
In simpler terms, this allows freed host pages to remain mapped within an attacker-controlled guest environment, simultaneously granting write permissions. According to the disclosure, an attacker can perform 64-bit reads and writes against the affected host page at predictable, static addresses. Notably, these operations do not trigger a trap or a virtual machine exit, enabling the attacker to manipulate host memory directly without resorting to traditional hypervisor escape methods.
### Implications and Scope of CVE-2026-89775
CVE-2026-89775 raises particular alarm for multi-tenant ARM64 cloud environments where nested virtualization is enabled. An attacker who can create or control a nested-virtualization-capable guest instance may exploit this vulnerability to transition from the guest operating system into the underlying host environment, potentially wreaking havoc on the host system.
Moreover, this vulnerability poses a considerable risk of local privilege escalation in vulnerable Linux distributions. The advisory highlights that specific distributions, including configurations of Red Hat Enterprise Linux, expose /dev/kvm with world-writable permissions set to 0666. If nested virtualization is enabled, it creates a scenario in which an unprivileged local user could access KVM and exploit the flaw to gain root-level access on the host.
The extent of exposure to this vulnerability varies based on several factors, including the specific ARM64 hardware in use, the kernel version, the availability of KVM, and whether nested virtualization is activated. Systems that do not employ KVM/arm64 nested virtualization are not expected to be affected by the outlined attack vector.
### Fixing the Issue
The vulnerable code was introduced in Linux commit 7270cc9157f47, dated May 14, 2025, and it remained in effect until the upstream fix was applied in commit 8053393680d4 on August 6, 2026. For affected system administrators, the recommendation is clear: they should update to a kernel release that includes the upstream patch or acquire a fixed kernel package from their vendor.
Furthermore, for cloud service providers utilizing ARM64 infrastructure, it is imperative to verify whether nested virtualization is exposed to tenants and to prioritize the patch’s deployment on shared hosts. As an interim protective measure, organizations that do not require nested virtualization for their operations are advised to disable it and limit access to /dev/kvm to trusted users and services.
Security teams are encouraged to conduct inventories of ARM64 virtualization hosts, thoroughly review kernel versions, and stay vigilant by monitoring vendor advisories for any backported fixes related to CVE-2026-89775. Given the potential severity of this vulnerability, timely action is essential in safeguarding systems against unwanted intrusions and maintaining the integrity of the computing environment.