By Abinaya
Publication Date: 2026-09-22 13:37:00
A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-89775, could let attackers escape an ARM64 virtual machine and access the underlying host system.
The issue affects KVM/arm64 environments where nested virtualization is enabled, creating a serious risk for multi-tenant cloud infrastructure and systems that allow untrusted users to create virtual machines.
Security researcher Hyunwoo Kim reported that the flaw stems from a type truncation issue in the KVM/arm64 stage-1 page-table walk process.
The bug affects how the kernel calculates the size of a memory region it must invalidate from the virtual CPU’s pseudo Translation Lookaside Buffer, or pseudo-TLB.
Under normal conditions, KVM must invalidate stale memory translations after memory mappings change. This prevents a guest virtual machine from continuing to access memory that has been released, moved, or reassigned by the host kernel.
In the vulnerable code path, however, the affected size calculation can return 0, a value intended to mean that the memory size is unknown.
The VNCR pseudo-TLB invalidation logic incorrectly treats the 0 value as a valid range size.
This produces an empty invalidation range, causing the required invalidation operation to be skipped entirely. As a result, stale memory access information can remain available to a malicious guest.
Linux KVM/arm64 Vulnerability
According to the disclosure, a freed host memory page can remain mapped as writable at a…
