ARM64 KVM Nested Virtualization Flaw Enables Guest-to-Host Memory Access

CVE-2026-89775 is a guest-to-host escape vulnerability in Linux KVM on ARM64 systems with nested virtualization enabled. A stage-1 page-table walk-level truncation can cause a range-size calculation to return zero; VNCR pseudo-TLB invalidation then skips invalidation, potentially leaving a freed host page mapped and writable at a fixed host-kernel address. A malicious guest can obtain 64-bit read/write access to host kernel memory and may be able to execute code on the host.

The issue affects multi-tenant ARM64 cloud deployments that expose nested-virtualization-capable instances and local systems where unprivileged users can access /dev/kvm. Nested virtualization is experimental, disabled by default, and requires Armv8.4 FEAT_NV2 hardware, limiting exposure. Upstream fixed the flaw in commit 8053393680d4; fixes are available in Linux 6.18.51, 7.2.5, and 7.3-rc1. No public exploit or active exploitation had been reported.