CVE-2026-89775 leaves a freed host page mapped and writable inside ARM64 KVM guests

A guest arranges its memory so that a size calculation in KVM's nested-virtualization code comes out as zero, and the TLB invalidation that should clear stale entries from the processor's address cache never runs ^[6]. A page of host memory the kernel has already freed then stays mapped and writable, and the guest reads and writes it 64 bits at a time, with no hardware trap to hand control back to the host ^[7]. Kim says a guest can use this to escape its own virtual machine and run code on the underlying machine ^[3]. No exploit code has been published, and there is no sign the flaw has been used in an attack ^[8].

Which hosts are actually vulnerable is not settled. The kernel's own record lists the affected code as present from Linux 6.16, though the author tagged the fix against a later change ^[9]. The maintainer who reviewed and tested it said the "missed invalidation only starts at v6.17" ^[10]. By that account a 6.16 host carries the code but not the behavior an attacker needs ^[11].

Vendor scores run from 7.8 to 9.3 out of 10, a spread of 1.5 points on a bug where they agree the impact is high and the attack is local, meaning it cannot be launched over a network ^[17][1]. The spread reflects how difficult each vendor thinks the flaw is to exploit ^[18]. Ubuntu publishes the 9.3 figure and sets its own priority to medium ^[19].

The second path starts with a local user on the host. On systems where any user can open /dev/kvm, the device a program uses to create a virtual machine, a local user could build a guest and use the same bug to gain root, Kim says ^[12]. Red Hat leaves that device open to all users by default ^[13], and lists its Red Hat Enterprise Linux 10 kernel as affected, with versions 6 through 9 not affected ^[14]. Either way, the host still needs nested virtualization enabled ^[15].

For tenants on the two largest clouds, the configuration this flaw needs is not on offer. Amazon Web Services lists nested virtualization only on Intel-based instances, and Google Cloud excludes its ARM virtual machines from it ^[21]. Their standard ARM offerings do not expose the reported path ^[22].

This is the fourth KVM guest-to-host escape Kim has disclosed this year, one in each month from June to September: ITScape on ARM64 in June, Januscape on x86 in July, Zapscape on x86 in August, and CVE-2026-89775 this month ^[23][2]. He called ITScape the first such escape shown publicly on ARM64 ^[24].