Critical Linux KVM Flaw Lets arm64 Guests Escape Virtual Machines

Linux kernel developers fixed a critical KVM vulnerability, CVE-2026-89775, on 6 August 2026. Rated 9.3 (Critical) under CVSSv3, the flaw affects arm64 systems running nested virtualisation and could allow an attacker in a guest virtual machine to escape to the host. The article says local attackers may also use it for local privilege escalation on multi-tenant hosts. No exploitation in the wild or public proof-of-concept has been confirmed; the reported EPSS probability is 0.2% over 30 days.

The issue is described as a type-truncation error during a stage-1 page-table walk. An invalidation range can become empty, causing invalidation to be skipped, while a resulting zero is treated as a valid size. This can leave a freed host page writable and mapped at a fixed address in the host kernel, giving the attacking guest direct 64-bit read and write access without triggering a virtual-machine exit. Affected code spans commits 7270cc9157f47 through 8053393680d4, including Linux 6.16, where arm64 nested virtualisation is explicitly enabled.

Administrators should update host kernels to a release containing the fixes, including commit 8053393680d4fa3eb962667d2be95dd39f0940e5 and version 6.18.51, among the listed patched versions. As interim measures, cloud operators can disable nested virtualisation on arm64 hosts and restrict permissions on the KVM device node.