ARM64 KVM Vulnerability Lets Guest VMs Read Host Kernel Memory

A new vulnerability in the Linux kernel’s KVM virtualization module for ARM64 processors has been identified by researchers as CVE‑2026‑89775. The bug permits a guest virtual machine to access freed portions of the host’s kernel memory when nested virtualization is enabled, potentially allowing an attacker to escape the VM sandbox and execute code directly on the host system.¹

The flaw arises from incorrect handling of Translation Lookaside Buffer (TLB) entries after memory deallocation within nested virtualization scenarios. When a container orchestration platform such as Kubernetes uses containerd or CRI‑O—common since early 2023 following Docker Swarm decline—the TLB can be left pointing at stale data that a malicious guest can then read or overwrite. This exposure gives attackers not only the ability to exfiltrate sensitive information but also arbitrary code execution via a hypervisor escape.

In practice, exploiting the defect requires precise timing; however, once achieved it mirrors earlier high‑profile bugs like Xen’s QEMU race condition disclosed in April 2021. Similar to that incident, the ARM64 issue could allow attackers to pivot into production hosts even if they control only a single guest instance. The potential impact spans cloud providers, edge devices, and any environment running nested VMs, including Amazon EC2 instances where analogous exploits were seen in Q3 ’17 before patches became available two weeks later.

Security specialists note that this vulnerability underscores how rapidly complex software stacks propagate bugs despite rigorous testing efforts. Modern chip designs prioritize hardware isolation yet remain imperfect due to design tradeoffs made over decades based upon Moore Law scaling limits now approaching physical boundaries near ~8 Angstrom resolution measurements currently achievable commercially speaking.

Affected systems include all Linux distributions with KVM support on ARM64 CPUs when nested virtualization is enabled.

The flaw also raises concerns about regulatory compliance under frameworks such as the Digital Operational Resilience Act (DORA), which mandates continuous monitoring and automated response capabilities.¹ While DORA’s second year focuses on operational visibility, many financial institutions struggle to correlate alerts across diverse legacy infrastructure pre‑cloud adoption; a breach exploiting CVE‑2026‑89775 could bypass existing detection rules if not properly instrumented.

In short, the discovery of CVE‑2026‑89775 highlights an urgent need for vendors and operators to review nested virtualization configurations, apply patches promptly, and strengthen hypervisor hardening measures. The incident serves as a reminder that even mature operating system components can harbor subtle bugs capable of undermining data confidentiality in today’s highly virtualized environments.