Linux ARM64 KVM Bug Lets Guests Access Host Memory
A kernel flaw in ARM64 virtualization allows local guests to read and write host memory, though only if nested virtualization is enabled.
Key points
- CVE-2026-89775 allows ARM64 KVM guests to read and write host memory if nested virtualization is enabled.
- The flaw is fixed in Linux kernels 6.18.51, 7.2.5, and 7.3-rc1, with distribution-specific patches available.
- The vulnerability is local and requires specific hardware features, limiting the attack surface for standard deployments.
A security flaw in the Linux kernel has exposed a significant risk for systems running ARM64 processors. The bug, identified as CVE-2026-89775, allows a virtual machine guest to access memory belonging to the host system. This breach of isolation means that a compromised virtual environment could potentially read sensitive data or execute code on the underlying physical machine.
The vulnerability exists in the KVM virtualization code, specifically within the nested virtualization feature. According to The Hacker News, the issue arises when a specific size calculation fails, causing the system to skip a necessary cleanup step. This leaves a piece of freed host memory mapped and writable by the guest, creating a direct bridge between the virtual and physical environments.
Nested virtualization is the key risk factor
The flaw only manifests when nested virtualization is enabled, a feature that allows a guest to run its own hypervisor. On ARM64 systems, this mode is off by default and requires specific hardware support. Consequently, standard cloud or server deployments that do not explicitly enable this experimental feature are not currently vulnerable. The attack surface is therefore limited to specialized configurations where users run virtual machines inside other virtual machines.
However, for those who do enable this feature, the stakes are high. A local user with access to the KVM device file could theoretically build a guest and use the bug to gain root privileges on the host. This local attack vector is concerning for multi-tenant environments, although it cannot be launched over a network. The lack of a hardware trap means the guest can manipulate host memory without the system realizing it is being attacked.
Patches arrive in specific kernel versions
The flaw is fixed in Linux kernel versions 6.18.51, 7.2.5, and 7.3-rc1. Distribution status varies, with Red Hat Enterprise Linux version 10 affected, while versions 6 through 9 are safe. Ubuntu users face a mixed situation; the 26.04 release is vulnerable, but the general kernel for 24.04 LTS is not. However, newer hardware-enablement kernels for 24.04 are susceptible. Administrators must check their specific kernel version to determine if they are at risk.
For systems that cannot be immediately patched, Red Hat has stated that there is no suitable workaround. The only guaranteed mitigation is to ensure that nested virtualization remains disabled. Security vendors have scored the flaw between 7.8 and 9.3 out of 10, reflecting its high impact. Despite the severity, there is no evidence of active exploitation, and the flaw is not listed in the U.S. CISA catalog of exploited vulnerabilities.
No active attacks detected yet
As of late September, the predicted exploitation score for this vulnerability remains below one percent. This low probability suggests that the complexity required to exploit the flaw is a barrier for most attackers. Nevertheless, the ability to escape a virtual machine and gain host access is a critical failure in isolation. Organizations relying on ARM64 infrastructure should prioritize patching to close this gap before it becomes a common target.
