CVE-2026-89775: ARM64 Guest Gains Host Memory Access via KVM TLB…

A flaw in TLB invalidation size calculation lets a KVM guest read and write host physical memory without a VM exit. On RHEL-like distributions, world-writable /dev/kvm turns the bug into a reliable local privilege escalation path.

On September 16, 2026, researcher Hyunwoo Kim disclosed CVE-2026-89775, a vulnerability in the Linux kernel's KVM subsystem for ARM64 that allows a virtual guest to obtain read and write access to the host system's physical memory. The bug stems from mishandling of the stage-1 walk level during calculation of the VNCR pseudo-TLB invalidation size, enabling a local privilege escalation path on enterprise distributions with world-writable /dev/kvm. This is the fourth KVM escape of 2026 discovered by the same researcher through Google's kvmCTF program.

Key Takeaways

CVE-2026-89775 carries a CVSS 9.3 (CRITICAL) rating and is caused by a type truncation that produces a zero size, skipping TLB invalidation and leaving a freed host page mapped writable to the guest.
The vulnerable configuration requires nested virtualization enabled on Armv8.4 hardware with FEAT_NV2, an experimental mode that is disabled by default.
On RHEL and similar distributions, /dev/kvm with 0666 permissions allows an unprivileged local user to create a guest and escalate to root by exploiting the same vulnerability.
Patches are available in Linux 6.18.51, 7.2.5, and 7.3-rc1; the vulnerable code was introduced in commits dated May 14, 2025.

The Mechanism: When a Signed Integer Becomes Zero Without Warning

The root cause lies in the pgshift_level_to_ttl() function, which converts the stage-1 walk level into an invalidation size for the VNCR (Virtual Nested Control Register) pseudo-TLB. When the S1 level equals S1_MMU_DISABLED = -127, the cast to u8 produces an unexpected value, and the subsequent size computation returns zero.

According to Hyunwoo Kim's OSS-Security advisory, "the invalidation range becomes an empty interval and the invalidation is always skipped." The result is that a freed host memory page remains mapped with write permissions at a fixed address in the host kernel. The malicious guest gains 64-bit reads and writes to that page "without any trap or VM exit" — direct, invisible access to the hypervisor.

The commit that introduced the vulnerable code is 7270cc9157f47, dated May 14, 2025. The three fix commits — be54a70067c7, 1c9fca34b962, and 8053393680d4 — have been merged into upstream kernel versions 6.18.51, 7.2.5, and 7.3-rc1.

The LPE Path: Why RHEL's Default Amplifies the Risk

The vulnerability presents a second significant vector on systems where /dev/kvm is writable by any local user. Per Kim's advisory, "On distributions such as RHEL, /dev/kvm is world-writable (0666), so if nested virtualization is enabled on the host, an unprivileged user can use this vulnerability as a reliable LPE to gain root." This transforms a host-guest isolation bug into a universal privilege escalation tool on the physical machine.

Red Hat has confirmed that RHEL 10 uses an affected kernel, while releases 6-9 are not affected. The company also noted that no available mitigation meets the criteria to be classified as an official workaround, leaving patch application as the only documented solution.

The combination of an experimental configuration (nested virtualization on ARM64) with a permissive default permission (world-writable /dev/kvm) illustrates how distribution-level security assumptions can interact with architectural bugs in unexpected ways.

Where It Hits: The Distribution and Cloud Provider Landscape

The vulnerability does not affect all Linux systems indiscriminately. The vulnerable code is present only starting with kernels 6.16/6.17 and requires Armv8.4 hardware with the FEAT_NV2 extension. The Hacker News reports that Ubuntu 26.04, including kernels optimized for AWS, Azure, and Google Cloud Platform, is vulnerable; Ubuntu 24.04 LTS in its general kernel is not, while HWE kernels 6.17 and 7.0 are. Amazon AL2023 with kernel 6.18 has a fix pending; other Amazon Linux kernels are unaffected. Debian Bookworm and Trixie are not affected because the code is absent; Debian Sid received the fix in kernel version 7.2.6-1, while Forky is vulnerable.

On the public cloud front, attack surfaces appear limited: AWS offers nested virtualization only on Intel instances, not ARM; Google Cloud explicitly excludes ARM virtual machines from nested virtualization support. This reduces risk for managed service tenants, though it does not eliminate it for self-hosted or private cloud infrastructures running ARM64.

A Systematic Pattern: Hyunwoo Kim's 2026 and kvmCTF

CVE-2026-89775 is the fourth KVM escape disclosure by Hyunwoo Kim in 2026, following ITScape (June, ARM64), Januscape (July, x86), and Zapscape (August, x86). The researcher operates within kvmCTF, Google's bug bounty program launched in June 2024 to incentivize systematic research on Linux hypervisor isolation and security.

The pattern is significant: a single operator, with access to a structured test infrastructure, is uncovering latent vulnerabilities in code considered mature and under continuous community review. The concentration of discoveries in 2026 suggests that the hypervisor attack surface — particularly in less-traveled paths like ARM64 nested virtualization — retains significant unexplored territory.

"A freed host page stays mapped writable at a fixed address in the host kernel, and the attacking guest obtains 64-bit reads and writes to that page without any trap or VM exit." — Hyunwoo Kim, OSS-Security advisory

What to Do Now

Priority actions derive directly from primary source guidance:

Apply kernel patches 6.18.51, 7.2.5 or later, or upgrade to 7.3-rc1, verifying that commits be54a70067c7, 1c9fca34b962, and 8053393680d4 are included in the distributed build.
Verify nested virtualization status on ARM64 systems: if enabled for specific requirements, evaluate temporary disablement pending patching, considering workload impact.
Check /dev/kvm permissions on enterprise distributions, with particular attention to RHEL-like configurations that set world-writable access: restricting access to users in the kvm group reduces the local LPE attack surface.
For operators of self-hosted ARM64 cloud infrastructures, validate that nested virtualization access policies reflect awareness of the documented risk, independent of upstream patch availability.

No signs of in-the-wild exploitation have emerged as of September 22, 2026, and no public PoC has been released. The CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. According to The Hacker News, the predicted exploitation score is below 1%, though the bug's severity — with potential for complete host compromise — keeps priority high for exposed environments.

Why This Bug Matters Beyond the Single Incident

The significance of CVE-2026-89775 lies in how it exposes two structural fragilities: the handling of integer types in kernel code that processes level values as signed integers, and the implicit assumption that experimental configurations not enabled by default are sufficiently protected by device access permissions. The combination of type truncation with a local escalation path via permissive device permissions shows how the security of a complex system depends not on a single component, but on unforeseen interactions between different architectural layers.

Kim's work, made economically sustainable by kvmCTF, indicates that systematic hypervisor research — especially on emerging architectures like ARM64 with nested virtualization — is producing measurable, repeatable results. For infrastructure operators, the lesson is that patches arrive after discovery, and visibility into experimental configurations and default permissions must be an integral part of the threat model.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter