New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

A critical vulnerability tracked as CVE-2026-89775 has been discovered in the Linux kernel's KVM virtualization subsystem affecting ARM64 processors. The flaw exposes freed host memory to guest virtual machines when nested virtualization is enabled. An attacker with access to a guest VM can exploit this bug to read and write host kernel memory. The vulnerability can potentially be leveraged to escape the guest VM environment entirely and execute arbitrary code on the host machine. This represents a severe hypervisor escape scenario with significant implications for cloud and virtualization environments running ARM64-based KVM hosts.