Linux Kernel ARM64 KVM VHE Flaw Enables Guest Host Memory Read/Write

A race condition in the ARM64 KVM virtualization host extensions (VHE) path allows a guest VM to retain access to freed host memory when nested virtualization is enabled, leading to arbitrary host kernel memory read/write. The flaw, tracked as CVE-2026-89775 (CVSS 9.8), can be chained via the ITScape exploit to achieve full guest‑to‑host escape and root‑level code execution on the host. Affected systems include any Linux kernel on ARM64 with KVM VHE and nested virt enabled, notably RHEL 8.4 EUS and its derivatives. Immediate mitigation requires applying the upstream kernel patch or disabling nested virtualization.

• Vulnerability Overview
• CVE-2026-89775 affects ARM64 KVM with VHE and nested virtualization.
• Root cause: use‑after‑free of a host memory page in the KVM VHE flow.

• Disclosed publicly September 2026; independently found by multiple researchers.

• Technical Mechanics / Race Condition

• Involves kvm_vcpu and vhe_stage2_pt structures during VM exit handling.
• Improper synchronization permits a guest to reference a page after it has been freed.

• The race window occurs when nested page tables are torn down while a guest still holds a reference.

• Exploitation & Impact

• ITScape PoC triggers the race, leaks host kernel pointers, and gains arbitrary read/write.
• Primitive can be chained to overwrite critical kernel data, achieving host code execution.
• Impact: guest‑to‑host privilege escalation, potential container escape or hypervisor break‑in.

• CVSS vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (9.8).

• Detection & Mitigation

• Apply the upstream kernel patch that fixes the VHE race condition.
• If patching is delayed, disable nested virtualization (kvm_intel.nested=0 or kvm_amd.nested=0).
• Restrict untrusted workloads from using KVM guests with VHE enabled.

• Monitor for abnormal guest‑to‑host memory access via auditd or eBPF tracing.

• Conclusion / Recommendations

• Prioritize patching of affected ARM64 kernels; the fix is available in mainline and vendor updates.
• Verify nested virt is disabled on systems where immediate patching is not feasible.
• Review guest workloads for unnecessary use of VHE‑enabled KVM instances.
• Maintain visibility through logging and anomaly detection to catch exploitation attempts.