CVE-2026-89775Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from the combination of the base granule size and the mapping level. However, this implies that the S1 MMU is *on*. When the MMU is off, we indicate this with the level being set to a "creative" value of -127 (S1_MMU_DISABLED). This ends-up being misinterpreted by pgshift_level_to_ttl() as it doesn't handle negative levels at all (the level is immediately cast to a u8 and only the bottom two bits considered), leading to an invalidation size of 0. Not helpful. Tidy-up pgshift_level_to_ttl() to handle these negative levels, and ttl_to_size() to always return SZ_1G when no valid TTL is present. This allows the removal of open-coded checks for similar situations. Note that the check for a negative value not explicitely checking for S1_MMU_DISABLED is deliberate, so that actual negative levels introduced with LVA2 and D128 can take the same path if we ever support them.

Back to dashboard

2.3/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
35 mentions across 11 observed days
Momentum state: declining

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 15 signals
Technical details provided in 32 signals
Disclosure: 19 classified signals
General: 2 classified signals
Peaked 6d ago at 21 mentions (2026-09-22); latest day: 1
35 total mentions across 11 days

Deep dive

Activity timeline35 mentions / 11d

Signal classification4 categories

Disclosure

1954.3%

Patch

1337.1%

General

25.7%

PoC

12.9%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-16	1	Patch1
2026-09-17	2	Patch2
2026-09-18	1	Disclosure1
2026-09-21	4	Disclosure3PoC1
2026-09-22	21	Disclosure12General2Patch7
2026-09-23	1	Patch1
2026-09-24	1	Disclosure1
2026-09-28	1	Patch1
2026-09-29	1	Patch1
2026-10-26	1	Disclosure1
2026-10-30	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews40d
Disclosure
🛑 New Linux KVM flaw CVE-2026-89775 can let an ARM64 guest escape to the host. When nested virtualization is enabled, the bug can leave freed host kernel memory mapped and writable. No attacks have been reported. How the escape works ↓ https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html
Post summary
The text discloses CVE-2026-89775, a Linux KVM vulnerability allowing ARM64 guest-to-host escape when nested virtualization is enabled, and explicitly states no attacks have been reported. It provides technical details of the flaw but contains no PoC, exploit tool, active exploitation claims, or patch/remediation information.
114231773441.2K
2.4M followersView on X
Cyber Security News@The_Cyber_News40d
Disclosure
🛡️ Linux KVM/arm64 Vulnerability Lets Attackers Escape Virtual Machines and Gain Host Access Details: https://cybersecuritynews.com/linux-kvm-arm64-vulnerability/ A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-89775, could let attackers escape an ARM64 virtual machine and access the underlying host system. The issue affects KVM/arm64 environments where nested virtualization is enabled, creating a serious risk for multi-tenant cloud infrastructure and systems that allow untrusted users to create virtual machines. The bug affects how the kernel calculates the size of a memory region it must invalidate from the virtual CPU’s pseudo-Translation Lookaside Buffer, or pseudo-TLB. Under normal conditions, KVM must invalidate stale memory translations after memory mappings change. #cybersecuritynews
Post summary
The text announces a newly disclosed Linux KVM/arm64 VM escape vulnerability and provides limited technical details. It does not mention a PoC, exploit tool, active exploitation, or patch/workaround.
5400176377.5K
76.0K followersView on X
Sekurak@Sekurak34d
Patch
🚨 Krytyczna luka w Linux KVM na ARM64 [CVE-2026-89775] 🛠️ Poprzez błąd związany z rzutowaniem typów istniała możliwość uzyskania dostępu do pamięci hosta, a w szczególnych przypadkach nawet RCE. 🧠 Aby podatność mogła być wykorzystana, w systemie musi być aktywna funkcja nested virtualization. 🛡️ Poprawka bezpieczeństwa została wydana. Zalecamy aktualizację jądra systemu. 👉 Szczegóły: https://sekurak.pl/krytyczna-luka-w-linux-kvm-na-arm64-w-okreslonych-warunkach-mozna-przejac-kontrole-nad-hostem-cve-2026-89775/
Post summary
The post discloses CVE-2026-89775, a type-confusion vulnerability in Linux KVM/ARM64 requiring nested virtualization, and confirms a security patch with kernel update has been released.
0405224.7K
45.2K followersView on X
ThreatWire@ThreatWire_40d
Patch
🚨 CRITICAL: CVE-2026-89775 is a Linux KVM/arm64 guest-to-host escape affecting systems with nested virtualization enabled. A flaw in KVM’s VNCR TLB invalidation logic can leave a freed host page mapped writable, allowing a malicious guest to access host memory and potentially escape the VM. 🎯 Impact: Multi-tenant arm64 cloud environments that allow nested virtualization are particularly exposed. ⚠️ CVSS 9.3 — Critical. 🔴 Fixed in Linux 6.18.51, 7.2.5 and 7.3-rc1. Update affected KVM hosts. 🔗 https://www.openwall.com/lists/oss-security/2026/09/16/14 #Linux #KVM #Virtualization #CloudSecurity #CVE #CyberSecurity #Infosec
Post summary
Critical Linux KVM/arm64 guest-to-host escape via VNCR TLB invalidation flaw (CVSS 9.3) with specific fixed kernel versions provided, making remediation the primary takeaway.
120154805
1.9K followersView on X
Nicolas Krassas@Dinosn41d
Disclosure
CVE-2026-89775: Guest-to-Host Escape in KVM/arm64 https://www.openwall.com/lists/oss-security/2026/09/16/14
Post summary
The text announces CVE-2026-89775 as a guest-to-host escape in KVM/arm64 and links to an oss-security discussion. It provides technical vulnerability details but lacks PoC, exploit, active exploitation, and patch indicators.
0201285.1K
162.6K followersView on X
FastFoodRembrandt.onion@solminingpunk40d
Disclosure
#ALERT 🚨 Linux KVM flaw CVE-2026-89775 can let an ARM64 guest escape to the host. When nested virtualization is enabled, the bug can leave freed host kernel memory mapped and writable. No attacks have been reported. #cybersecurity How the escape works: https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html
Post summary
The text announces a new Linux KVM vulnerability (CVE-2026-89775) affecting ARM64 guests under nested virtualization, providing technical details of the memory mapping flaw while noting no active attacks have been reported.
110120418
6.9K followersView on X
Rıdvan Yağlı@ridvanyagli46d
Patch
🔴 Linux KVM/arm64'te kritik CVE-2026-89775 - Guest-to-Host Escape açığı (CVSS 9.3) ! Nested virtualization etkin sistemlerde, negatif S1 walking level değerinin hatalı işlenmesi nedeniyle VNCR-TLB invalidation boyutu 0 hesaplanabiliyor ve gerekli invalidation atlanabiliyor. Bu durum, serbest bırakılmış host kernel belleğinin writable olarak map'li kalmasına ve uygun koşullarda Guest-to-Host Escape gerçekleştirilmesine yol açabiliyor. Fix mainline'da 8053393680d4 commit'iyle yayınlandı, upstream'de yamalandı. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8053393680d4
Post summary
The tweet discloses a critical CVE-2026-89775 in Linux KVM/arm64 enabling guest-to-host escape, provides technical details (CVSS 9.3), and notes that a fix has been committed to mainline and upstream patched.
00083584
2.5K followersView on X
tpx Security ⠠⠵@tpx_Security40d
Patch
Se reveló la vulnerabilidad CVE-2026-89775 en el hipervisor KVM del kernel de Linux para arquitecturas ARM64. El fallo en el proceso de invalidación de memoria pseudo-TLB cuando la virtualización anidada está activa permite a una máquina virtual huésped acceder directamente a la memoria del sistema anfitrión (host), rompiendo el aislamiento de inquilinos en entornos multi-tenant de nube. Se urge a los administradores y proveedores cloud a aplicar los parches del código principal (mainline) del kernel de Linux.
Post summary
The text discloses technical details of CVE-2026-89775 in Linux KVM on ARM64 and urges administrators to apply mainline kernel patches.
12060257
3.8K followersView on X
Frank@jedisct141d
Disclosure
CVE-2026-89775: Guest-to-Host Escape in KVM/arm64 https://www.openwall.com/lists/oss-security/2026/09/16/14
Post summary
The text announces CVE-2026-89775, a guest-to-host escape vulnerability in KVM/arm64, referencing an oss-security mailing list post. No exploit, patch, or active exploitation details are provided.
110611.4K
18.2K followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Patch
A critical KVM guest escape (CVE-2026-89775) enables an LPE to gain root on Linux hosts. Patch this KVM guest escape vulnerability now. #KVM #LinuxKernel #CVE202689775 #Cybersecurity #InfoSec https://securityonline.info/kvm-guest-escape-cve-2026-89775/
Post summary
The tweet highlights a critical KVM guest escape (CVE-2026-89775) allowing LPE to root and urges immediate patching, without mentioning exploits, PoCs, or active exploitation.
01021488
13.0K followersView on X
ngCERT@ngCERTofficial2d
Disclosure
🚨 CRITICAL: CVE-2026-89775 A type truncation bug in KVM’s nested virtualization code skips a needed invalidation, leaving freed host memory readable and writable by a guest. Read more on our website https://cert.gov.ng/advisories/linux-kvmarm64-guest-to-host-escape-vulnerability #Linux #KVM #ARM64 #InfoSec https://t.co/BAnNDrFk57
Post summary
The text discloses CVE-2026-89775, describing a type truncation bug in KVM nested virtualization that exposes freed host memory to guests, without referencing PoCs, exploits, active attacks, or remediation steps.
02010176
1.4K followersView on X
CyberSignal | Cybersecurity & AI News@XQOPTRX40d
Disclosure
🚨 NEW LINUX KERNEL FLAW CAN BREAK THE VIRTUAL MACHINE BOUNDARY ON ARM64 CVE-2026-89775 affects Linux KVM when ARM64 nested virtualization is enabled. Researchers say the flaw can expose freed host-kernel memory to a malicious guest. Potential consequence: Compromised VM ↓ Host kernel memory access ↓ Read/write primitives ↓ Potential guest-to-host escape Important caveat: ARM64 nested virtualization is experimental and disabled by default, dramatically reducing the general attack surface. No active exploitation has been reported. Still, hypervisor boundaries are among the most important isolation layers in modern infrastructure. When that boundary fails, one VM can become a problem for the entire host. Source: Linux security research · The Hacker News #LinuxSecurity
Post summary
The text announces CVE-2026-89775, a Linux kernel flaw in KVM on ARM64 that can break VM boundaries, but does not mention a PoC, exploit tool, patch, or active exploitation. It is primarily a vulnerability disclosure with technical details.
0102057
233 followersView on X
P.K. Sharma@_pksharma40d
Patch
Three comforting sentences are doing a lot of work in the coverage of the new ARM64 KVM flaw. Nested virtualisation is off by default. It is experimental. Red Hat says it does not work on ARM at all. All three are true. None of them is a control. Now the record. CVE-2026-89775 lets a guest read and write a page of host memory that the host has already freed. The behaviour reached shipping kernels with Linux 6.17 on 28 September 2025. The stable fix arrived on 11 September 2026, in 6.18.51 and 7.2.5. That is 348 days, and two stable lines took their final release inside that window: 6.17.13 in December, 7.0.14 in June. Neither will ever carry the fix, because the fix was not written until August. The reassuring half is real too. The flaw is only reachable on a host booted with kvm-arm.mode=nested, on Armv8.4 hardware with FEAT_NV2. Managed cloud tenants on Arm instances cannot switch that on: AWS lists Intel families only, Google Cloud excludes virtual machines powered by Arm processors, and Azure Arm sizes record it as not supported. That leaves the people who run their own Arm hypervisors, and one boot line as the only place the answer lives. A parameter added eighteen months ago to test a nested setup, by an engineer who has since moved on, is still set, and nothing will announce it. So the question is not whether you are affected. It is this: which of your ARM64 hosts boot with kvm-arm.mode=nested today, and can you answer that from a record rather than by logging in and looking? Full briefing, with the version ranges and the checks: https://www.pk-sharma.com/briefing/linux-arm64-kvm-nested-escape-exposure #CyberSecurity #Linux #CloudSecurity
Post summary
The text discusses CVE-2026-89775, an ARM64 KVM nested-virtualization memory-safety flaw, and provides specific reachability conditions plus stable fixes in Linux 6.18.51 and 7.2.5. It does not report active exploitation, PoC, or named exploit tooling.
1001051
188 followersView on X
Autumn Good@autumn_good_3541d
Disclosure
『if nested virtualization is enabled on the host, an unprivileged user can use this vulnerability as a reliable LPE to gain root.』 CVE-2026-89775: Guest-to-Host Escape in KVM/arm64 https://www.openwall.com/lists/oss-security/2026/09/16/14
Post summary
The post describes a KVM/arm64 guest-to-host escape enabling reliable LPE to root when nested virtualization is enabled, without providing PoC, exploit tooling, active exploitation, or patch details.
00020599
7.3K followersView on X
Hackers Online Club (HOC)@HOCupdate40d
General
Linux Kernel Flaw (CVE-2026-89775): ARM64 KVM Guests Gain Host Read-Write | Read -• https://hackersonlineclub.com/linux-kernel-arm64-kvm-memory-flaw-cve-2026-89775/
Post summary
No CVE-specific target text was provided in the input; only the analysis instructions were present. All indicators are marked NO and the classification is General due to the absence of any CVE content to analyze.
10000374
27.2K followersView on X
✪ 𝕱𝖆𝖍𝖆𝖉@fad_77741d
PoC
ثغرات الهروب من الضيف إلى المضيف في KVM/arm64 تضرب حدّ العزل الذي تعتمد عليه الافتراضية. CVE-2026-89775 مهم لأنه يرتبط بإمكانية تجاوز العزل بين الآلة الافتراضية والمضيف، وهي من أخطر فئات الثغرات في بيئات KVM على معمارية arm64. القيمة التقنية هنا ليست في رقم CVE فقط، بل في مراجعة مسارات التنفيذ المتأثرة، نموذج التهديد، وآليات تقليل المخاطر في الأنظمة التي تعتمد على KVM/arm64. عمليًا، يجب التعامل معه كأولوية تقييم في بيئات الافتراضية التي تستخدم arm64، خصوصًا عند تشغيل أحمال عمل غير موثوقة أو متعددة المستأجرين. A guest-to-host escape in KVM/arm64 is a direct challenge to the core security boundary of virtualization. CVE-2026-89775 matters because it targets the separation between a virtual machine and the host, one of the most security-critical assumptions in KVM-based environments. The technical value is in understanding the affected execution paths, validating the threat model, and reviewing available mitigations for ARM64 virtualization deployments. For teams operating KVM on arm64, this should be prioritized for exposure assessment, especially where untrusted or multi-tenant workloads are present. https://www.openwall.com/lists/oss-security/2026/09/16/14 #KVM #ARM64 #VirtualizationSecurity
Post summary
The text announces and emphasizes the criticality of CVE-2026-89775, a guest-to-host escape vulnerability in KVM/arm64, providing substantial technical details about its impact, and links to a source likely containing further technical analysis or PoC, making the existence and sharing of the PoC the central focus.
0001061
91 followersView on X
NEXSIGHT@NEXSIGHTNEWS45d
Patch
LinuxカーネルのKVM/arm64にゲスト仮想マシンからホストへ抜け出せる脆弱性CVE-2026-89775（CVSS 9.3）— ネスト仮想化を有効にしたarm64ホストが対象、6.18.51と7.2.5以降では修正済み https://cyber.nexsight.co/articles/2026/09/17/kvm-arm64-cve-2026-89775-guest-to-host-escape-2026-09-17/
Post summary
The tweet announces CVE‑2026‑89775, a critical (CVSS 9.3) KVM/arm64 guest‑to‑host escape, notes that it is patched in kernel versions 6.18.51 and 7.2.5+, and provides a link to a detailed article.
0000181
72 followersView on X
MLAUNCHER@MLUNCHER6d
Disclosure
این آسیب‌ پذیری جدید در کرنل لینوکس با شناسه CVE-2026-89775 در کد مجازی ‌سازی KVM برای پردازنده ‌های ARM64 شناسایی شده که در قربانی هایی که مجازی ‌سازی تو‌در‌تو Nested Virtualization روشون فعاله میتونه بخشی از حافظه آزاد شده میزبان رو در اختیار ماشین مجازی....
Post summary
The text reports a newly identified Linux kernel vulnerability (CVE-2026-89775) in KVM for ARM64, affecting nested virtualization (HVMGuest) and potentially allowing guest access to host freed memory. No proof of concept, exploit, patch, or active exploitation is mentioned.
0000026
24 followersView on X
iototsecnews@iototsecnews34d
Patch
Linux KVM の脆弱性 CVE-2026-89775 が FIX：ARM64 システムに生じる深刻な問題とは？ https://iototsecnews.jp/2026/09/22/critical-linux-kvm-flaw-enables-guest-to-host-escape-on-arm64-systems/ 紹介記事は Linux KVM における特定の脆弱性 CVE-2026-89775 を取り上げています。ARM64 環境でネスト仮想化制御構造を処理する際、型の切り捨てが原因でアドレス変換時のサイズ計算に狂いが生じます。無効化処理のスキップ／解放済みメモリの意図しない保持／ゲストからの直接操作という一連の問題により、攻撃者による仮想マシン脱出や host 上での権限昇格を引き起こす恐れがあります。特にマルチテナント型のクラウド環境では共有基盤全体の安全性が脅かされる事態へ直結します。安全確保のためには、修正済みカーネルへの更新／不要なネスト機能の無効化／デバイスファイルへのアクセス制御の見直しが強く求められます。 #CVE202689775 #LinuxKVM #Vulnerability
Post summary
The article analyzes CVE-2026-89775 in Linux KVM for ARM64 systems, explaining the vulnerability's technical root cause and recommending patches (e.g., updated kernel) and mitigations like disabling nested virtualization features.
00000137
518 followersView on X
General Intels Daily@intels_daily38d
Disclosure
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗗𝗶𝘀𝗰𝘂𝘀𝘀𝗶𝗼𝗻 🧩 Products: 𝗟𝗶𝗻𝘂𝘅 𝗸𝗲𝗿𝗻𝗲𝗹, 𝗞𝗩𝗠, 𝗔𝗥𝗠𝟲𝟰 🛡️ CVE-2026-89775 The post discusses a critical vulnerability (CVE-2026-89775) in the Linux kernel's KVM virtualization code for ARM64 architectures. The flaw allows guest virtual machines to access, read, and write to host kernel memory, potentially enabling a guest-to-host escape and arbitrary code execution on the host system. #ThreatIntel #CTI
Post summary
The post discloses a critical CVE-2026-89775 in the Linux kernel KVM for ARM64 that allows guest virtual machines to read/write host kernel memory, enabling guest-to-host escape and arbitrary code execution. No PoC, exploit, patch, or active exploitation is mentioned.
00000142
740 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-89775

Cyber Security News[verified]@The_Cyber_NewsDisclosure

The text announces a newly disclosed Linux KVM/arm64 VM escape vulnerability and provides limited technical details. It does not mention a PoC, exploit tool, active exploitation, or patch/workaround.

Sekurak[verified]@SekurakPatch

The post discloses CVE-2026-89775, a type-confusion vulnerability in Linux KVM/ARM64 requiring nested virtualization, and confirms a security patch with kernel update has been released.

ThreatWire[verified]@ThreatWire_Patch

Critical Linux KVM/arm64 guest-to-host escape via VNCR TLB invalidation flaw (CVSS 9.3) with specific fixed kernel versions provided, making remediation the primary takeaway.

Nicolas Krassas[verified]@DinosnDisclosure

The text announces CVE-2026-89775 as a guest-to-host escape in KVM/arm64 and links to an oss-security discussion. It provides technical vulnerability details but lacks PoC, exploit, active exploitation, and patch indicators.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The tweet discloses a critical CVE-2026-89775 in Linux KVM/arm64 enabling guest-to-host escape, provides technical details (CVSS 9.3), and notes that a fix has been committed to mainline and upstream patched.

tpx Security ⠠⠵[verified]@tpx_SecurityPatch

The text discloses technical details of CVE-2026-89775 in Linux KVM on ARM64 and urges administrators to apply mainline kernel patches.

Frank[verified]@jedisct1Disclosure

The text announces CVE-2026-89775, a guest-to-host escape vulnerability in KVM/arm64, referencing an oss-security mailing list post. No exploit, patch, or active exploitation details are provided.

ngCERT[verified]@ngCERTofficialDisclosure

The text discloses CVE-2026-89775, describing a type truncation bug in KVM nested virtualization that exposes freed host memory to guests, without referencing PoCs, exploits, active attacks, or remediation steps.