Linux ARM64 KVM flaw allows host memory access

The issue sat in KVM's nested virtualisation path for ARM64. When a guest laid out memory in a particular way, a size check reached zero and the invalidation step did not run, which left freed host memory mapped and writable.

That memory could then be read and written in 64-bit chunks without a trap back to the host. Hyunwoo Kim, who reported the flaw and disclosed it on 16 September, said that path could let a guest break out and run code on the host.

Kim said no exploit code had been published and there was no sign of active abuse. He also said the kernel's own record placed the affected code from Linux 6.16, while the fix author and reviewer said the missed invalidation started at v6.17.

He described a second route on systems where any user could open /dev/kvm, saying a local user could create a guest and use the bug to gain root. He pointed to Red Hat Enterprise Linux, with Red Hat listing version 10 as affected and versions 6 through 9 as not affected.

Upstream fixes landed in Linux 6.18.51, 7.2.5 and 7.3-rc1, and Red Hat said it had no workaround that met its criteria. Vendors scored it from 7.8 to 9.3, CISA had not listed it as exploited as of 22 September, its predicted exploitation score was below 1%, and AWS and Google Cloud did not expose the required nested-virtualisation setup on their standard ARM offerings.