Security News New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

[Captain Awesome]

Content source

https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html?m=1

A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled.

The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine.

The affected code is part of the mainline Linux kernel for ARM64, and it is fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1.

Nested virtualization allows a guest to run its own hypervisor, enabling it to host virtual machines. On ARM64, it is off by default. It is an experimental boot-time mode that needs Armv8.4 hardware with a feature called FEAT_NV2, so a plain ARM64 KVM host that never turns it on is outside the reported attack path.

 

[Bot AI]

Hi, this is a serious guest-to-host escape, but the reported attack surface is narrow: ARM64 KVM hosts with nested virtualization enabled. Ordinary Linux desktops, x86 KVM hosts, ARM64 systems not running KVM guests, and ARM64 KVM hosts without nested virtualization are not in the described path.

What the flaw permits​

The vulnerable KVM/arm64 code can miscalculate a mapping size as “unknown.” Consequently, a freed host page remains mapped writable at a fixed kernel address, giving the malicious guest 64-bit read and write access without causing a trap or VM exit.

That primitive is sufficient for a credible VM escape: isolation between the guest and host can be defeated, potentially allowing code execution in the host context. This is substantially more serious than merely exposing data belonging to another guest. [1]

Who needs to act​

The affected mainline range is reported by commit boundary:

Host configuration	Reported exposure
ARM64 KVM with nested virtualization enabled	Affected if running vulnerable code
ARM64 KVM without nested virtualization	Outside the reported attack path
x86/x86-64 KVM	Not affected by this KVM/arm64 flaw
ARM64 device not hosting KVM guests	No guest attack surface described here

The supplied disclosure identifies the vulnerable range as beginning with commit `7270cc9157f47` (2025-05-14) and ending with the patch commit `8053393680d4` (2026-08-06). Distribution kernels may backport either commit, so the displayed kernel version alone is not always decisive. [1]

Recommended response​

1. Check whether the host is ARM64 and actually uses KVM nested virtualization. If not, this particular escape is not an urgent exposure.
2. Apply the security kernel supplied by the distribution or hosting vendor. Confirm that it contains fix commit `8053393680d4` or the vendor’s corresponding backport.
3. Reboot into the updated kernel. Installing a kernel package does not replace the kernel currently running.
4. If patching must wait, disable nested virtualization and reboot, provided nested guests are not operationally required. Treat untrusted guests as unsafe until the host is fixed.
5. For shared ARM64 virtualization infrastructure, check every physical host, not the guest kernels. The vulnerability is in the host’s KVM implementation.

The quoted release numbers—6.18.51, 7.2.5 and 7.3-rc1—are not confirmed by the supplied disclosure, which identifies the fix by commit instead. I would therefore rely on the distribution advisory or verify the backported commit rather than assume that any similarly numbered vendor kernel is safe. [1]

Sources

1. oss-security - CVE-2026-89775: Guest-to-Host Escape in KVM/arm64

 

[RansomwareRemediation]

So much for Linux being so secure, right? A low blow for the fans.

 

[lokamoka820]

So much for Linux being so secure, right? A low blow for the fans.

The flaw only affects ARM64 processors, is off by default, still experimental, and was fixed immediately, meaning no real infections occurred.

 

[RansomwareRemediation]

The flaw only affects ARM64 processors, is off by default, still experimental, and was fixed immediately, meaning no real infections occurred.

It doesn't matter. My point is that Linux isn't *as* secure as everyone thinks, and most of its flaws are at the kernel level.

 

[Parkinsond]

It doesn't matter. My point is that Linux isn't *as* secure as everyone thinks, and most of its flaws are at the kernel level.

"actively"

Security News Thread 'CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks'

Saturday at 12:21 PM

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting three Linux kernel vulnerabilities, creating an urgent patching and investigation deadline.

CISA also marked all three vulnerabilities as requiring forensic triage, meaning affected agencies must investigate potentially exposed assets for evidence of compromise rather than treating patch installation as the only response activity.

https://cybersecuritynews.com/linux-kernel-vulnerabilities-actively-exploited/

• Parkinsond
• Replies: 0
• Forum: Security News

• 
• 
• 

 

[Jonny Quest]

It doesn't matter. My point is that Linux isn't *as* secure as everyone thinks, and most of its flaws are at the kernel level.

But, what is the ratio compared to Windows flaws, attacks and the number of users possibly affected? And this seems like a really specific and targeted attack, and how many are actually going to be affected? Isn't that what used to said about the Mac OS, as far as it being incredibly secure?

 

[lokamoka820]

But, what is the ratio compared to Windows flaws, attacks and the number of users possibly affected? And this seems like a really specific and targeted attack, and how many are actually going to be affected?

Exactly, and if I remember correctly, all discovered vulnerabilities in Linux require the attacker to be physically present in front of the device to gain access, which could impact large servers rather than home users.

Isn't that what used to said about the Mac OS, as far as it being incredibly secure?

Nothing is 100% secure, but saying Linux or macOS is more secure refers to how they are built, how they deliver updates, manage permissions, and handle software installation, which is a crucial factor. Windows really needs to be rebuilt from scratch to improve security because, technically, its current situation is a mess.

 

[Zero Knowledge]

It doesn't matter. My point is that Linux isn't *as* secure as everyone thinks, and most of its flaws are at the kernel level.

What's better a Kernel exploit or a RCE in printspooler, power service or FONT rendering? When it comes to security even I acknowledge Linux is safer.

As @lokamoka820 said NOTHING is 100% even air-gap military networks. Windows is a shitshow though, no wonder AI is finding 1000 bugs/vulns/exploits a month.