On ARM64 hosts, a guest virtual machine can reach a page of memory the host has already released – and keep writing to it. The researcher who found it says that is enough to leave the guest behind.
The flaw is CVE-2026-89775, in the Linux kernel’s nested virtualization code. Hyunwoo Kim published it on September 16; upstream fixes exist in Linux 6.18.51, 7.2.5 and 7.3-rc1.
An experimental mode with a gap
Turning nested virtualization on is a deliberate act. It lets one guest run a hypervisor of its own so machines can be nested inside machines. ARM64 ships with the feature disabled, and enabling it counts as experimental: the silicon must be Armv8.4 or later and expose a capability called FEAT_NV2.
The failure begins with arithmetic. A guest that lays out memory in a particular pattern drives a size calculation to zero, and the kernel responds by skipping the TLB invalidation it owed the hardware – the flush that purges stale processor address-cache entries. What remains is a page the host already freed, still mapped and writable. The guest works on it 64 bits at a time, and no hardware trap pulls control back.
Where it lands
There is a second avenue. Any system that lets ordinary users open /dev/kvm gives a local attacker room to build a guest and convert the same bug into root. RHEL permits that by default and lists its version 10 kernel as affected. Versions 6 through 9 are not.
Ubuntu 26.04 and the newer hardware-enablement kernels on 24.04 are exposed, as is Debian forky. Bookworm and trixie are not. Vendor scores land between 7.8 and 9.3 and the attack stays local. CISA has not added it; AWS sells nested virtualization only on Intel instances, and Google Cloud keeps it off its ARM machines.
