Freed Memory Stayed Accessible
CVE-2026-89775, in arm64 KVM allowing guests to run hypervisors, permits guest writes after its host frees a page.
It reads and overwrites 64-bit units without traps or exiting into the hypervisor, enabling tenant escape or local escalation through unprivileged /dev/kvm access.
A truncated stage-one translation depth yields zero, meaning unknown. VNCR software translation-cache invalidation interprets that as a range covering nothing and skips invalidation.
Development, CI and research hosts may enable nesting without offering it. Other host and hypervisor configurations remain outside the disclosed scope.
- Inventory hypervisors, architecture and nesting.
- Match the running package to distribution guidance: backports can include the bug or fix.
- Restrict device access; justify each user’s and service’s need.
- Prioritise shared hosts allowing untrusted guests.
- Patch, reboot and verify the running kernel.
- Review host logs and workload history during exposure.
Vulnerable history begins May 2025. The fix was authored 6 August 2026, committed 8 August. Distribution availability differs.
The research notice (17 September 2026 header) makes no exploitation claim; absence remains unestablished.
