Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

A flaw in the Linux kernel’s KVM virtualization code for ARM64 processors, tracked as CVE-2026-89775, can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled.

The researcher who found the bug says it allows a guest to read and write host kernel memory, and can be used to escape the guest and run code on the host machine. Cloud providers and operators running nested ARM64 KVM virtualization should prioritize patching.