Executive Summary
A critical vulnerability in the Linux kernel's KVM virtualization code for ARM64 processors, tracked as CVE-2026-89775, allows guest virtual machines to read and write host kernel memory when nested virtualization is enabled. Discovered by security researcher Hyunwoo Kim and disclosed in September 2026, the flaw affects Linux kernels 6.17 and later, enabling potential guest-to-host escapes on systems with experimental nested virtualization features. The vulnerability has been patched in Linux 6.18.51, 7.2.5, and 7.3-rc1, though distribution adoption varies by vendor.
This incident highlights the growing security challenges in cloud infrastructure as virtualization technologies become more complex and nested environments gain adoption. With major cloud providers increasingly offering ARM-based instances and advanced virtualization features, vulnerabilities like CVE-2026-89775 underscore the critical need for robust hypervisor security.
Why This Matters Now
ARM-based cloud infrastructure is rapidly expanding across major providers, and nested virtualization capabilities are becoming standard offerings. This vulnerability demonstrates how advanced virtualization features can introduce critical security gaps that bypass traditional isolation boundaries.
Attack Path Analysis
Attacker exploits CVE-2026-89775 in Linux KVM ARM64 nested virtualization to gain initial access to guest VM memory. Through memory manipulation and TLB invalidation bypass, attacker escalates privileges to access freed host kernel memory with read-write capabilities. Attacker leverages host memory access to move laterally across virtualized infrastructure and establish persistent command channels. Using compromised host access, attacker exfiltrates sensitive data from multiple guest VMs and host systems. Finally, attacker causes widespread virtualization infrastructure disruption affecting multiple tenants and services.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker exploits CVE-2026-89775 in ARM64 KVM nested virtualization by arranging guest memory to trigger zero-size calculation, bypassing TLB invalidation and gaining access to freed host memory pages
Related CVEs
CVE-2026-89775
CVSS 9.3A flaw in the Linux kernel's KVM virtualization code for ARM64 processors allows guest virtual machines to read and write host kernel memory on hosts with nested virtualization enabled, potentially leading to guest-to-host escape.
Affected Products:
Linux Linux Kernel – 6.17, 6.18.1-6.18.50, 7.0-7.2.4, 7.3-rc versions prior to 7.3-rc1
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploitation for Defense Evasion
Exploitation for Privilege Escalation
Escape to Host
Process Injection
OS Credential Dumping
Valid Accounts
Data Manipulation: Stored Data Manipulation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security Vulnerability Management
Control ID: 6.2.2
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.16
DORA – ICT Risk Management Framework
Control ID: Article 11
CISA ZTMM 2.0 – Device Identity and Integrity
Control ID: Device Security
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21
ISO 27001 – Management of Technical Vulnerabilities
Control ID: A.12.6.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Linux ARM64 KVM vulnerability enables guest-to-host escapes in virtualization infrastructure, compromising cloud platforms and data center security through nested virtualization exploitation.
Computer Software/Engineering
Critical Linux kernel flaw affects virtualization software development, requiring immediate patches for ARM64 systems and enhanced security testing for hypervisor technologies.
Financial Services
Virtualized banking infrastructure faces privilege escalation risks from KVM vulnerability, potentially exposing sensitive financial data through compromised host memory access.
Health Care / Life Sciences
Healthcare virtualization platforms vulnerable to guest VM escapes, risking HIPAA compliance violations and patient data exposure through ARM64 KVM memory exploitation.
Sources
- New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memoryhttps://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.htmlVerified
- CVE-2026-89775 Disclosure on OSS Security Mailing Listhttps://www.openwall.com/lists/oss-security/2026/09/16/14Verified
- CVE-2026-89775 Recordhttps://www.cve.org/CVERecord?id=CVE-2026-89775Verified
- Red Hat Enterprise Linux 10 Release Notes - Kernel Parameters Changeshttps://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/10/html/10.1_release_notes/kernel_parameters_changesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this ARM64 KVM hypervisor escape by constraining lateral movement and data exfiltration paths. While the initial virtualization exploit might still succeed, segmentation policies would limit attacker reach across the virtualized infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial hypervisor compromise may still occur, but CNSF workload isolation policies would likely constrain the attacker's ability to expand access beyond the directly compromised virtualization components
Control: Zero Trust Segmentation
Mitigation: Host-level memory access may still be achieved, but Zero Trust policies would likely reduce the attacker's ability to leverage elevated privileges across segmented virtualization infrastructure and tenant boundaries
Control: East-West Traffic Security
Mitigation: Lateral movement across guest VMs and hypervisor components would likely be significantly constrained by east-west traffic policies that restrict inter-workload communication paths and enforce identity-based access controls
Control: Multicloud Visibility & Control
Mitigation: Command and control establishment may occur, but multicloud visibility policies would likely constrain persistent access by monitoring and restricting communication flows through virtualization management interfaces across cloud environments
Control: Egress Security & Policy Enforcement
Mitigation: Data extraction attempts would likely be constrained by egress policies that monitor and restrict outbound data flows from hypervisor and guest VM environments, limiting the volume and scope of exfiltrable information
Service disruption impact would likely be reduced to isolated tenant segments rather than widespread infrastructure failure, with contained availability issues affecting fewer virtualized workloads and cloud service components
Impact at a Glance
Affected Business Functions
- Cloud Infrastructure Services
- Virtualization Platform Operations
- ARM64-based Server Hosting
- Nested Virtualization Environments
Estimated downtime: 3 days
Estimated loss: N/A
Potential exposure of host kernel memory contents to guest virtual machines, including sensitive system data, cryptographic keys, and other processes' memory contents on ARM64 systems with nested virtualization enabled
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate virtualization infrastructure and limit blast radius from hypervisor-level compromises
- • Deploy Multicloud Visibility & Control to monitor anomalous interactions between guest VMs and hypervisor components across ARM64 environments
- • Enable Egress Security & Policy Enforcement to detect unauthorized data exfiltration from compromised virtualization infrastructure
- • Utilize Threat Detection & Anomaly Response capabilities to baseline normal hypervisor behavior and alert on memory access anomalies
- • Apply Cloud Native Security Fabric inline enforcement to inspect and control virtualization management traffic in real-time
