HOC Shorts
Tracked as CVE-2026-89775, a vulnerability in the Linux kernel’s KVM subsystem exposes freed host memory pages to guest virtual machines on ARM64 systems.
- The Root Cause: A type-truncation bug in the stage-1 page-table size computation leads to skipped pseudo-TLB invalidations for nested virtualization, leaving stale host kernel memory mapped as writable.
- Impact: Allows guest-to-host VM escapes, 64-bit arbitrary host memory read/write access, and local privilege escalation to root on vulnerable host environments (e.g., RHEL with world-writable `/dev/kvm`).
- Prerequisites: Requires ARM64 hardware with `FEAT_NV2` support and nested virtualization explicitly enabled (off by default).
- Remediation: Patched in mainline upstream kernel releases (including `6.18.51`, `7.2.5`, and `7.3-rc1`).
The Security researcher disclosed a critical vulnerability in the Linux kernel’s Kernel-based Virtual Machine (KVM) subsystem on ARM64 architectures. Tracked as CVE-2026-89775, the flaw allows a malicious guest virtual machine to bypass hypervisor isolation boundaries, granting 64-bit arbitrary read and write access to freed host kernel memory pages.
The vulnerability poses a severe risk to multi-tenant cloud environments and enterprise virtualization stacks running ARM64 hardware, where an attacker controlling an isolated guest instance could break out to execute arbitrary code on the underlying hypervisor host.
Technical Breakdown – Infographic
1. Type Truncation in Size Computation: When nested virtualization is active, KVM calculates the stage-1 page-table walk level. A type-truncation error causes the size-computation function to evaluate to `0`.
2. Skipped TLB Invalidation: In this code path, `0` signifies an “unknown” size. The Virtual Nested Control Register (VNCR) pseudo-TLB invalidation mechanism incorrectly processes `0` as a legitimate size, generating an empty invalidation range and skipping necessary TLB flushes.
3. Stale Writable Mapping: Because the TLB invalidation is skipped, a host memory page that was freed remains mapped as writable at a fixed kernel address. The guest retains direct access, enabling guest-to-host read/write primitives without causing a VM exit or hypervisor trap.
Attack Vectors & Impact
- Cloud VM Escapes: In multi-tenant ARM64 cloud platforms providing nested virtualization (allowing guests to run their own hypervisors), an attacker can leverage this primitive to escape their tenant VM and compromise the underlying physical server.
- Local Host Privilege Escalation: On systems where `/dev/kvm` is accessible to unprivileged users (e.g., Red Hat Enterprise Linux 10 configurations with `0666` permissions), a local attacker can instantiate a KVM guest and exploit the flaw to elevate privileges to root on the host OS.
Scope & Mitigations
- Prerequisites: The attack path is restricted to ARM64 processors with `FEAT_NV2` hardware extensions where experimental nested virtualization is explicitly enabled at boot time. Standard ARM64 KVM deployments without nested virtualization enabled are not vulnerable to this specific memory exposure.
- Fixed Kernel Versions: Upstream fixes have been integrated into mainline Linux commits, including fixed releases 6.18.51, 7.2.5, and 7.3-rc1.
Action Items:
– Restrict `/dev/kvm` device node permissions to trusted administrative groups.
– Disable nested virtualization on ARM64 host hypervisors unless strictly required.
– Apply vendor kernel updates as soon as distribution patches are published.
