Critical Linux Kernel Vulnerability Disclosed
A recently unveiled vulnerability within the Linux kernel, designated CVE-2026-89775, poses a potential threat, allowing attackers to escape an ARM64 virtual machine and gain unauthorized access to the host system beneath.
This concern pertains specifically to KVM/arm64 environments where nested virtualization is activated, presenting a significant risk, particularly to multi-tenant cloud infrastructures and systems permitting untrusted users to establish virtual machines.
Security analyst Hyunwoo Kim reported that the root of the issue arises from a type truncation error in the KVM/arm64 stage-1 page-table management process.
The flaw disrupts the kernel’s procedure when determining the size of a memory region designated for invalidation from the pseudo Translation Lookaside Buffer (pseudo-TLB) of the virtual CPU.
Typically, KVM is tasked with invalidating outdated memory translations following alterations in memory mappings.
This mechanism is essential to prevent a guest virtual machine from accessing memory that the host kernel has previously released, relocated, or reassigned.
However, within the flawed code path, the size calculation can mistakenly yield a value of 0, signifying an unknown memory size. The VNCR pseudo-TLB invalidation mechanism erroneously considers this 0 value as a legitimate range size.
This oversight generates an empty invalidation range, leading to the complete omission of the necessary invalidation operation. Consequently, obsolete memory access information remains accessible to an infiltrating guest.
Linux KVM/arm64 Security Risk
The disclosure indicates that a deallocated host memory page could continue to be mapped as writable at a designated host-kernel address.
An attacker within the guest environment could leverage this to gain 64-bit read and write access to that page, circumventing the need for a trap or virtual machine exit.
Such behavior presents a vector for an assailant to directly manipulate host memory from within the guest realm.
This vulnerability holds particular relevance for public cloud deployments utilizing ARM64 infrastructure. An attacker capable of instantiating a nested virtualization-enabled environment could potentially traverse from the guest system to the host.
Should this maneuver succeed, it could obliterate the isolation barrier that ordinarily keeps one client’s virtual machine segregated from the cloud provider’s foundational infrastructure.
Furthermore, this situation may also engender a localized privilege-escalation threat. The report has indicated that certain distributions, such as Red Hat Enterprise Linux configurations, may expose /dev/kvm with permissive world-writable settings of 0666.
With nested virtualization enabled, an unprivileged local user might exploit this vulnerability to obtain root privileges on the host.
The flaw affects Linux kernel code introduced by commit 7270cc9157f47, recorded on May 14, 2025, and has been rectified upstream by commit 8053393680d4, dated August 6, 2026.
System administrators are urged to promptly update to a kernel version that includes the primary fix once it becomes available from their distribution vendor.
Additionally, organizations managing ARM64 KVM hosts should assess the necessity of nested virtualization. Disabling this feature where it is not essential could mitigate exposure while patches are implemented.
Cloud service providers must prioritize the patching of shared infrastructure, evaluate tenant access to nested virtualization, and review permissions on /dev/kvm to curtail opportunities for local exploitation. The disclosure has confirmed that a patch is included in the Linux mainline kernel.
Source link: Cybersecuritynews.com.
