Linux Kernel Bug Lets ARM64 Virtual Machines Peek Into Host Memory

A security flaw tracked as CVE-2026-89775 has been found in the Linux kernel's ARM64 virtualization code, specifically in the part that manages nested virtualization (where a virtual machine runs its own virtual machines inside it). Under certain conditions, a memory calculation error means a piece of freed host memory is left accessible to a guest virtual machine, without the usual safety checks that would normally block this. A researcher who reported the issue says it could allow a guest to break out of its virtual machine and run code directly on the host server.

The flaw only affects systems where nested virtualization is turned on, which is not the default setting on ARM64 hardware and requires specific processor features. It also affects Linux kernel versions from around 6.17 onwards, though maintainer commentary suggests earlier versions may carry the vulnerable code without the exploitable behaviour. A second attack path exists on systems, including some Red Hat Enterprise Linux versions, where any local user can access the virtualization device by default, potentially allowing a local user to gain root access.

The issue has been fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. No exploit code has been published and there is no evidence of active exploitation at this time.