Linux KVM/arm64 guest-to-host escape CVE-2026-89775 (RH CVSS 8.8) when nested virt enabled

oss-security disclosure by Hyunwoo Kim (17 September 2026; embargo lift) and CVE published 16 September 2026: CVE-2026-89775 is a guest-to-host escape in KVM/arm64 when nested virtualization is enabled. Type truncation of the stage-1 walk level can make VNCR pseudo-TLB size computation return 0 (“size unknown”); invalidation treats that as an empty range and skips, leaving a freed host page mapped writable so a malicious guest gets 64-bit R/W without trap/VM-exit. Introduced mainline 7270cc9157f47 (14 May 2025); fixed 8053393680d4 (6 Aug 2026). Red Hat rates Important, CVSS 3.1 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). On hosts with nested virt and world-writable /dev/kvm (e.g. some RHEL configs), also a local root LPE path. Primary: oss-security; Red Hat CVE page; wire: The Hacker News / Cyber Security News 22 Sep 2026.

Product

Linux kernel KVM/arm64 (nested virtualization path); multi-tenant arm64 clouds and hosts exposing /dev/kvm

Versions

Vulnerable mainline window: commit 7270cc9157f47 (2025-05-14) through before 8053393680d4 (2026-08-06). Distro backports vary — follow vendor kernel advisories (Red Hat CVE page).

CVSS

8.8 (CVSS 3.1 Important; Red Hat)

Exploited in Australia?

unknown

Patch to

Apply vendor kernel updates that include the KVM/arm64 VNCR TLB fix; disable nested virtualization on untrusted multi-tenant arm64 hosts until patched; restrict /dev/kvm permissions where possible; prioritize public-cloud arm64 nodes that offer nested virt

Primary: oss-security — CVE-2026-89775 KVM/arm64 guest-to-host (Hyunwoo Kim) · Vendor: Red Hat — CVE-2026-89775 · CVE: CVE-2026-89775 · CVE.report — CVE-2026-89775; also The Hacker News 22 Sep 2026

vulnerabilities cloud network