A KVM ARM64 Flaw Could Break Virtual Machine Isolation

A Linux kernel vulnerability identified as CVE-2026-89775 could allow a virtual machine running on KVM/ARM64 to access host system memory when nested virtualization is enabled. The flaw affects part of the code responsible for invalidating memory translations and has been fixed in recent Linux kernel branches.

Key facts about CVE-2026-89775 in 20 seconds

• It affects KVM on ARM64 with nested virtualization enabled.
• The flaw can leave a host memory page accessible from the guest.
• Linux has released fixes for the 6.18, 7.2 and 7.3 kernel branches.
• The vulnerability has a CVSS 3.1 score of 9.3.
• Nested virtualization is disabled by default on ARM64.

The issue was reported by security researcher Hyunwoo Kim and publicly disclosed on September 16, 2026, after the coordinated embargo period ended. The advisory describes the vulnerability as a guest-to-host escape in KVM/arm64 when nested virtualization is being used.

The relevance to shared infrastructure is directly linked to the isolation boundary provided by virtualization. A virtual machine should be able to execute code without directly accessing the memory of the physical server hosting it. In the scenario described by the researcher, that boundary can be broken.

An incorrect calculation can disable a memory protection

CVE-2026-89775 is located in Linux KVM’s ARM64 code that handles translation-cache invalidation during nested virtualization. The root cause is related to how a negative level in the stage-1 page-table walk is handled when the Memory Management Unit (MMU) is disabled.

The code uses information about the table level and granularity to calculate how much memory needs to be invalidated in a structure known as the pseudo-Translation Lookaside Buffer (pseudo-TLB). The problem occurs because a negative value can be interpreted incorrectly during this calculation.

According to the official kernel record, the conversion can result in an invalidation size of zero. The value zero has a special meaning elsewhere in the code, but the VNCR path interprets it as a valid size. As a result, the invalidation operation ends up with an empty range and is not performed as intended.

This matters because stale memory translations must be removed when a memory mapping changes. If that cleanup does not happen, a reference that should no longer be valid can remain available.

In the scenario described by Kim, a host memory page that has already been freed can remain mapped with write permissions at a specific kernel address. A malicious guest can then obtain 64-bit read and write access to that page without triggering a virtual machine exit. The researcher says this condition can be used to escape the guest and access the host.

The risk is concentrated around nested virtualization

The most important condition when assessing the scope of the vulnerability is that nested virtualization must be enabled. This feature allows a virtual machine to run its own hypervisor and host additional virtual machines inside it.

On ARM64, this functionality is disabled by default and requires hardware support for specific Arm virtualization features. A KVM/ARM64 host that does not have nested virtualization enabled therefore does not fall within the described attack scenario.

The issue becomes more relevant in environments where untrusted users can create virtual machines and the cloud provider allows nested virtualization. In a multi-tenant cloud environment, a guest escape could undermine the isolation separating a customer’s workload from the underlying infrastructure.

The researcher’s advisory also describes a potential local privilege-escalation scenario. In certain distributions and configurations, including configurations mentioned for Red Hat Enterprise Linux, the /dev/kvm device may be available with world-writable permissions. If nested virtualization is also enabled, an unprivileged local user could potentially use the vulnerability to attempt to obtain elevated privileges on the host.

The vulnerability has a CVSS 3.1 score of 9.3 out of 10, with high impact on confidentiality, integrity and availability. The published vector classifies it as a local exploitation issue with low complexity, requiring no prior privileges or user interaction.

That does not mean that every ARM64 virtual machine is automatically vulnerable. The hypervisor configuration is decisive, particularly whether nested virtualization is enabled.

Linux has already released fixes

The kernel security team identifies the issue as having been introduced in Linux 6.16 and lists fixes in Linux 6.18.51, 7.2.5 and 7.3-rc1. The patches modify how negative levels are handled during invalidation-size calculations and establish a valid size when there is no applicable translation level.

The exact status can vary between Linux distributions because vendors and maintainers may backport the patches to their own kernel branches. Debian, for example, tracks the vulnerability across its supported packages and reports different fixed versions for different releases. Administrators should therefore check the security advisory for their specific distribution rather than relying only on the mainline kernel version.

Red Hat has also published information specifically covering CVE-2026-89775. Its description confirms that the issue is related to KVM on ARM64, the MMU state and an incorrect calculation of the region that must be invalidated.

While updates are being deployed, checking whether nested virtualization is actually required can reduce exposure. On servers where the feature is unnecessary, keeping it disabled removes the specific attack scenario described for CVE-2026-89775.

It is also worth reviewing /dev/kvm permissions and the configuration of hypervisors that provide nested virtualization. These are complementary measures and do not replace applying the kernel update.

The public disclosure does not, according to the available information, include a publicly released exploit code. There is also no public indication that the vulnerability has been used in real-world attacks. The researcher has nevertheless described an exploitation path that could reach host memory under the affected conditions.

For ARM64 infrastructure operators, the practical response is therefore relatively specific: identify KVM hosts with nested virtualization enabled, check the installed kernel against the security advisory for the relevant distribution, and apply the available update. On servers where nested virtualization is not required, keeping it disabled removes the affected configuration.

Frequently asked questions

What is CVE-2026-89775?
It is a Linux kernel vulnerability affecting KVM/ARM64 that can allow a virtual machine to escape to the underlying host when nested virtualization is enabled.

Which Linux versions contain the fix?
The kernel security team lists fixes in Linux 6.18.51, 7.2.5 and 7.3-rc1. Linux distributions may backport the patches to their own supported kernel versions.

Are all KVM ARM64 virtual machines affected?
No. The described attack scenario requires nested virtualization to be enabled. On ARM64, this feature is disabled by default.

What should administrators do?
They should check whether their ARM64 KVM hosts use nested virtualization and update the kernel through their distribution’s security packages. If the feature is not required, it can also be kept disabled.