CVE-2026-89775: ARM64 KVM Nested Virtualization Guest Escape — Detection, Mitigation, and Patching Guide

A newly disclosed Linux kernel vulnerability, CVE-2026-89775, affects KVM on ARM64 and is specifically relevant where nested virtualization is enabled. The public summary describes a lifecycle flaw in ARM64 KVM code that can leave a freed host memory region exposed to a guest VM, allowing that guest to read and write host kernel memory. The finder states this can be chained into a guest escape and host code execution.

For defenders, the severity model is straightforward: this is not a remote internet-facing bug by itself. It is a host-boundary failure. Any ARM64 virtualization host running untrusted or multi-tenant KVM guests with nested virtualization enabled should treat this as an urgent exposure until patched or until nested virtualization is disabled. The blast radius includes the hypervisor host, co-located guests, management plane credentials, images, secrets, and any workload reachable from the host.

Do not wait for a perfect CVSS number. The source item does not provide one, and no CVE beyond CVE-2026-89775 should be assumed. The defensive priority is to inventory ARM64 KVM hosts, determine whether nested virtualization is enabled, reduce attack surface immediately, and track stable/distro kernel fixes that explicitly reference CVE-2026-89775.

Technical Analysis

Affected component and platform: Linux kernel KVM for ARM64/aarch64, in environments using KVM virtualization with nested virtualization enabled. This concerns ARM64 hypervisor hosts, including cloud-like bare-metal virtualization nodes, edge appliances, CI runners, build farms, and development hosts that run VMs on ARM servers.

Vulnerability class: Based on the public summary, the bug appears to be a memory exposure / stale mapping after free condition in ARM64 KVM nested-virtualization handling. In practical terms, KVM failed to fully detach or invalidate a guest-visible mapping when the underlying host memory was freed. That can convert a normal host memory lifecycle operation into a cross-boundary read/write primitive.

Why ARM64 nested KVM matters: ARM64 virtualization relies heavily on stage-2 translation: guest intermediate physical addresses are translated to host physical addresses by the hypervisor. Nested virtualization adds another layer because an L1 guest can be given virtual EL2 capabilities and run its own L2 guests. That increases complexity in page-table handling, TLB invalidation, VMID management, context synchronization, and teardown ordering. A mistake during free/teardown in this path is dangerous because the hypervisor is trusted to enforce the one boundary that matters most: guest memory must never alias host kernel memory after release.

Attack chain from a defender's perspective:

1. Attacker controls or compromises code execution inside a guest VM on an ARM64 KVM host.
2. The host has KVM enabled and nested virtualization exposed to that guest or available to the relevant KVM path.
3. The attacker exercises guest/nested operations that trigger allocation, mapping, free, and re-use patterns around the vulnerable ARM64 KVM code.
4. A freed host memory region remains readable/writable from the guest context.
5. The attacker scans or shapes reallocation to place useful kernel data in the freed region, then reads sensitive data or corrupts host kernel structures.
6. Corruption is escalated into host kernel execution, after which the guest boundary is effectively gone.

Exploitation requirements: local control of a guest, ARM64 KVM host, nested virtualization enabled, and sufficient ability to exercise KVM/nested paths from the guest. A tenant VM, compromised build container that can spawn nested VMs, malicious image, or supply-chain payload running inside a VM could all satisfy the guest-side prerequisite.

Exploitation status: The provided item does not state confirmed in-the-wild exploitation, a public weaponized exploit, CISA KEV inclusion, or a fixed kernel version. Treat exploitation as credible and technically plausible because guest-to-host kernel read/write is a well-understood pathway to escape, but do not claim active exploitation unless your telemetry or later advisories confirm it.

Immediate Defensive Priorities

• Identify every aarch64 host with KVM, QEMU/KVM, libvirt, virt-manager, cloud-hypervisor, Firecracker-on-KVM, Kata, or custom KVM orchestration.
• Determine whether nested virtualization is enabled intentionally or accidentally. Pay special attention to CI/build hosts, Android/emulator farms, kernel test rigs, security research nodes, and multi-tenant ARM virtualization.
• Until patched, disable nested virtualization on untrusted or multi-tenant ARM64 KVM hosts, or migrate sensitive workloads away from hosts where nested cannot be disabled.
• Patch only when the kernel changelog or vendor advisory explicitly references CVE-2026-89775. Do not assume a routine minor kernel update covers it.

Detection & Response

The highest-value host telemetry is not a magic IOC; it is KVM state manipulation, unexpected nested/KVM changes, and post-escape behavior from virtualization processes. On a clean hypervisor, QEMU/libvirt processes should not spawn shells, compilers, downloaders, or kernel-debugging tooling.

---
title: Linux ARM64 KVM Module or Nested Parameter Tampering
id: 8f2b5a21-6c43-4d0a-9f7b-0a1c2d3e4f5a
status: experimental
description: Detects command-line attempts to inspect, load, unload, or modify KVM/ARM64 nested virtualization state, including sysfs parameter writes and boot configuration changes.
references:
  - https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - '/sys/module/kvm'
      - '/sys/module/kvm_arm'
      - 'kvm_arm'
      - 'kvm-arm.mode'
      - 'modprobe kvm'
      - 'rmmod kvm'
      - 'insmod kvm'
      - '/proc/cmdline'
      - 'grubby'
      - 'update-grub'
  filter_admin:
    User|contains:
      - 'root'
      - 'ansible'
      - 'terraform'
  condition: selection and not filter_admin
falsepositives:
  - Kernel tuning, hypervisor provisioning, and infrastructure-as-code runs.
level: medium
---
title: Unexpected Non-Virtualization Process Referencing KVM Device
id: 0f7a4c65-2b1d-4c8e-9a33-77aa11bb22cc
status: experimental
description: Detects processes outside expected virtualization stacks referencing /dev/kvm, which may indicate manual VM manipulation, tooling abuse, or guest-escape staging from the host side.
references:
  - https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - '/dev/kvm'
  filter_expected:
    Image|endswith:
      - '/qemu-system-aarch64'
      - '/qemu-kvm'
      - '/libvirtd'
      - '/virtqemud'
      - '/virsh'
      - '/cloud-hypervisor'
  condition: selection and not filter_expected
falsepositives:
  - Rare administrative debugging and custom orchestration agents.
level: high
---
title: Virtualization Process Spawning Shell or Tooling on Linux KVM Host
id: 5c19d883-4aa0-4f1d-b622-9c8d7e6f5a4b
status: experimental
description: Detects shells, interpreters, compilers, or network download tools spawned by QEMU/libvirt/KVM-related host processes, a strong post-escape or post-compromise signal on hypervisors.
references:
  - https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/qemu-system-aarch64'
      - '/qemu-kvm'
      - '/libvirtd'
      - '/virtqemud'
      - '/virsh'
      - '/cloud-hypervisor'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/ruby'
      - '/gcc'
      - '/clang'
      - '/make'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/socat'
      - '/gdb'
  condition: selection_parent and selection_child
falsepositives:
  - Libvirt hook scripts and tightly controlled orchestration jobs; baseline by host role.
level: high

let kvm_terms = dynamic(["CVE-2026-89775", "kvm_arm", "kvm-arm.mode", "nested", "stage-2", "EL2", "/dev/kvm", "qemu-system-aarch64", "virtqemud", "libvirtd"]);
union isfuzzy=true
(
  Syslog
  | where TimeGenerated > ago(14d)
  | where ProcessName has_any ("qemu", "kvm", "libvirt", "virsh", "kernel", "modprobe", "systemd") or Message has_any (kvm_terms)
  | where Message has_any (kvm_terms) or ProcessName has_any ("qemu", "libvirtd", "virtqemud", "modprobe")
  | project TimeGenerated, Computer, HostName, ProcessName, Facility, SeverityLevel, Message
),
(
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where DeviceName has_any ("arm", "aarch", "kvm", "virt") or ProcessCommandLine has_any (kvm_terms) or FileName has_any ("qemu", "libvirtd", "virtqemud", "modprobe", "rmmod", "virsh")
  | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
)
| order by TimeGenerated desc

-- ARM64 KVM host triage: virtualization processes, KVM state files, and unexpected children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(qemu|kvm|libvirt|virtd|virtqemud|cloud-hypervisor|firecracker|kata)'
   OR CommandLine =~ '(?i)(/dev/kvm|kvm_arm|kvm-arm.mode|nested|qemu-system-aarch64|virsh|libvirt)'

SELECT FullPath, Size, Mtime
FROM glob(globs=['/proc/cmdline', '/sys/module/kvm*/parameters/*', '/sys/module/kvm_arm*/parameters/*', '/etc/modprobe.d/*kvm*', '/etc/default/grub*'])

SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)/(bash|sh|python3?|perl|gcc|clang|curl|wget|nc|socat|gdb)$'
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)(qemu|libvirtd|virtqemud|cloud-hypervisor)')

#!/usr/bin/env bash
# Audit ARM64 KVM hosts for CVE-2026-89775 exposure. Run as root. Default is audit-only.
set -euo pipefail
APPLY=0
if [ "${1:-}" = "--apply-temporary-disable" ]; then APPLY=1; fi

echo "[+] arch: $(uname -m)  kernel: $(uname -r)"
if [ "$(uname -m)" != "aarch64" ]; then echo "[-] Not ARM64; KVM ARM64 nested exposure is not applicable."; exit 0; fi

echo "[+] kernel command line:"
tr ' ' '\n' </proc/cmdline | grep -Ei 'kvm|arm|nested|el2|virt' || true

echo "[+] loaded KVM modules:"
lsmod | grep -E '^kvm|kvm_arm' || echo "[-] no kvm modules loaded"

echo "[+] KVM module parameter candidates:"
for d in /sys/module/kvm /sys/module/kvm_arm /sys/module/kvm_arm64; do
  [ -d "$d" ] || continue
  echo "-- $d/parameters"
  grep -R . "$d/parameters" 2>/dev/null | grep -Ei 'nested|enable|mode|protected' || true
done

echo "[+] virtualization processes:"
ps -eo pid,ppid,user,comm,args | grep -Ei 'qemu|kvm|libvirtd|virtqemud|virsh|cloud-hypervisor|firecracker|kata' | grep -v grep || true

echo "[+] unexpected children of VM processes:"
for p in $(pgrep -f 'qemu|libvirtd|virtqemud|cloud-hypervisor' || true); do
  ps --ppid "$p" -o pid,ppid,comm,args 2>/dev/null | grep -E 'bash|sh|python|perl|gcc|clang|curl|wget|nc|socat|gdb' || true
done

if [ "$APPLY" -eq 1 ]; then
  echo "[!] Attempting temporary nested disable only where a writable nested-like parameter exists."
  found=0
  for f in /sys/module/kvm*/parameters/*nested* /sys/module/kvm*/parameters/*enable* /sys/module/kvm_arm*/parameters/*; do
    [ -e "$f" ] || continue
    case "$f" in *nested*|*enable*|*mode*) : ;; *) continue ;; esac
    if [ -w "$f" ]; then echo 0 > "$f" 2>/dev/null && { echo "[+] wrote 0 to $f"; found=1; } || true; fi
  done
  [ "$found" -eq 0 ] && echo "[-] no writable runtime parameter found; disable via kernel cmdline/distro KVM config and reboot."
  echo "[!] Persistent fix requires a kernel build whose changelog explicitly references CVE-2026-89775, then reboot."
fi

echo "[+] Done. If nested is required for business, isolate tenants, restrict /dev/kvm, and expedite patched kernel rollout."

Remediation

1. Inventory and isolate: Build an authoritative list of ARM64 hosts with KVM and label them by trust boundary: single-tenant trusted, multi-tenant untrusted, CI/ephemeral, research, production. Move sensitive workloads off hosts that must keep nested virtualization enabled before patch.
2. Disable nested virtualization until fixed: Use your distro/kernel-supported KVM ARM configuration to disable nested virtualization, or disable KVM entirely on nodes that do not need local virtualization. If runtime parameters are read-only, make the change persistent through the kernel command line or modprobe configuration and reboot during an approved window. Verify after reboot with the audit script above.
3. Patch decisively: Track your distribution security tracker and the upstream stable/LTS kernel changelog. Apply only kernels that explicitly list CVE-2026-89775, then reboot; KVM defects are not fixed by user-space QEMU/libvirt updates alone unless the vendor advisory says otherwise. Useful starting points: https://www.kernel.org/, https://lore.kernel.org/kvm/, and your distro security tracker for Red Hat, Ubuntu, Debian, SUSE, or Amazon Linux. Source context: https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html
4. Reduce guest-side blast radius: For required nested-virt hosts, restrict which tenants/images can request nested capability, disallow untrusted VM images, pin CI jobs to disposable single-tenant nodes, and enforce SELinux/AppArmor plus cgroup device rules so only approved virtualization stacks can open /dev/kvm.
5. Monitor hypervisor behavior: Alert on KVM module changes, edits to GRUB/kernel command line, /dev/kvm references by non-virt tools, and shells/interpreters/downloaders spawned by QEMU/libvirt. Treat any host-kernel oops, KVM WARN, stage-2 fault storm, or unexplained hypervisor reboot on an ARM64 KVM node as a potential incident until cleared.
6. IR posture: If you suspect exploitation, do not merely reboot and reuse the host. Capture memory if feasible, preserve /var/log, audit logs, libvirt/QEMU logs, kernel logs, guest console logs, and orchestration metadata. Assume host credentials, disk encryption keys, SSH keys, cloud instance metadata tokens, and co-tenant secrets may be exposed; rotate accordingly and rebuild the hypervisor from trusted media after patching.

No CISA KEV entry or vendor deadline is cited in the provided source. Monitor CISA KEV and distro advisories; if CVE-2026-89775 is added to KEV or a cloud provider issues an emergency notice, escalate patching accordingly.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub