CVE-2026-89775

A vulnerability in the Linux kernel's KVM virtualization code for ARM64 processors, tracked as CVE-2026-89775, allows a guest virtual machine to read and write host kernel memory, potentially enabling guest-to-host escape. The flaw affects systems with nested virtualization enabled and stems from a missed TLB invalidation due to a zero-size calculation when handling guest memory. It impacts Linux kernels starting from version 6.17 and has been patched in 6.18.51, 7.2.5, and 7.3-rc1. While no active exploitation has been observed, local users on vulnerable systems—such as those with /dev/kvm accessible—could exploit it to escalate privileges to root.