Do Son 
Linux kernel developers fixed a critical flaw tracked as CVE-2026-89775 in the KVM hypervisor on August 6, 2026. This severe KVM guest escape defect allows attackers to break out of virtual machines on arm64 processors. Furthermore, local attackers can use this flaw for an LPE to gain root on vulnerable multi-tenant hosts. System administrators running nested virtualization must patch their Linux kernels immediately.
- CVE: CVE-2026-89775
- CVSS: 9.3 (Critical · CVSSv3)
- Product: Linux
- Affected: 7270cc9157f474dfc46750a34c9d7defc686b2eb, 6.16
- Impact: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
- Status: No confirmed exploitation yet
- Patched in: be54a70067c7dbe1381157e8a238fa4b16ea9c05, 1c9fca34b9625a67a7f1a03c8604f3df760c6c49, 8053393680d4fa3eb962667d2be95dd39f0940e5, 6.18.51 (+2 more)
- EPSS: 0.2% (30-day)
- Action: Update to be54a70067c7dbe1381157e8a238fa4b16ea9c05, 1c9fca34b9625a67a7f1a03c8604f3df760c6c49, 8053393680d4fa3eb962667d2be95dd39f0940e5, 6.18.51 (+2 more) now
Track every Linux kernel CVE the moment it's exploited.
Get free email alertsWhy This Threat Matters
Industry estimates show that cloud providers operate millions of virtual machines on arm64 hardware. Therefore, hypervisor isolation failures represent an extreme risk to shared cloud environments. If an attacker executes a KVM guest escape, they gain full read and write access to host memory. Consequently, rogue tenants can compromise neighboring workloads or take over the entire physical server. On distributions like Red Hat Enterprise Linux, the KVM device file is world-writable. Thus, any unprivileged local user can use this weakness for an LPE to gain root privileges.
How the Attack Works
The vulnerability resides within KVM/arm64 systems that run nested virtualization. Specifically, a type truncation error occurs during the stage-1 page table walk. The advisory notes that “the invalidation range becomes an empty interval and the invalidation is always skipped.” In addition, the invalidation path treats the resulting zero as a valid size. Consequently, “a freed host page stays mapped writable at a fixed address in the host kernel.” The attacking guest then obtains direct 64-bit read and write permissions without triggering a VM exit. Currently, researchers confirm that no in-the-wild exploitation or public proof-of-concept exists.
Affected Versions
This flaw impacts Linux kernel versions from commit 7270cc9157f47 through commit 8053393680d4. Specifically, the issue only exposes arm64 systems that explicitly enable nested virtualization.
Patch and Mitigation Steps
Administrators should update their host kernels without delay. Upstream maintainers resolved the bug in the mainline Linux kernel patch. Moreover, to prevent a KVM guest escape, cloud operators can disable nested virtualization on arm64 hosts. Security teams should also restrict access permissions on the KVM device node.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
