High

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

The Hacker News

Overview

A newly discovered flaw in the Linux kernel's KVM virtualization code for ARM64 processors poses a significant risk. This vulnerability, identified as CVE-2026-89775, allows guest virtual machines with nested virtualization enabled to gain read-write access to freed host memory. Researchers warn that this could enable attackers to escape the guest environment and execute code directly on the host machine. This issue is particularly concerning for systems that rely heavily on virtualization for security and isolation, as it could compromise the integrity of the host operating environment. Users and organizations utilizing ARM64 virtualization should be aware of this vulnerability and take necessary precautions.

Key Takeaways

  • Affected Systems: ARM64 processors running Linux with KVM virtualization enabled, particularly those with nested virtualization features.
  • Action Required: Users should apply patches as they become available from their Linux distribution maintainers.
  • Timeline: Newly disclosed

Original Article Summary

A new flaw in the Linux kernel's KVM virtualization code for ARM64 processors can leave a freed piece of host memory exposed to a guest virtual machine on hosts with nested virtualization enabled. The bug, tracked as CVE-2026-89775, allows a guest to read and write host kernel memory, and the researcher who found it says it can be used to escape the guest and run code on the host machine.

Impact

ARM64 processors running Linux with KVM virtualization enabled, particularly those with nested virtualization features.

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Users should apply patches as they become available from their Linux distribution maintainers. It is advisable to review and configure nested virtualization settings carefully and consider disabling this feature until a fix is in place.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, CVE, Vulnerability.

Related Coverage

D-Link warns of max severity zero-day bug in DIR-822A routers

BleepingComputer

D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.

Sep 22, 2026

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

The Hacker News

A vulnerability in SharePoint Server, originally labeled by Microsoft as a spoofing flaw with a CVSS score of 6.5, has been reclassified to allow for authenticated remote code execution (RCE). This flaw, identified as CVE-2026-65660, impacts SharePoint Server versions 2016, 2019, and Subscription Edition. Researcher Dinh Ho Anh Khoa from Viettel Cyber Security provided detailed technical insights, revealing the severity of the issue. The ability for attackers to execute remote code poses significant risks, especially for organizations relying on these SharePoint versions for collaboration and data management. Microsoft has released patches to address this vulnerability, and users are urged to apply these updates promptly to protect their systems.

Sep 22, 2026

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

The Hacker News

Researchers have discovered a malicious npm package called 'indexed-btree' that masquerades as a legitimate tool used for B-tree indexing. Unlike typical malicious packages that employ lifecycle scripts to execute harmful actions, this one hides its malicious behavior within the application code itself. This shift in tactics suggests that attackers are adapting to new security measures that aim to protect users from obvious threats. The package mimics a trusted utility, potentially tricking developers into integrating it into their projects. This incident raises concerns for developers and organizations relying on npm packages, as it illustrates the evolving nature of supply chain attacks in the software development ecosystem.

Sep 22, 2026

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

The Hacker News

The cyber group known as SideCopy has shifted its focus to academic institutions in India, previously known for targeting government entities. Researchers from Trellix have reported that SideCopy is employing spear-phishing tactics that utilize mshta.exe to run harmful scripts, effectively bypassing typical security measures. This change in target demographic raises concerns about the security of educational institutions, which may not have the same level of protection as government systems. The use of advanced phishing techniques indicates a growing sophistication in SideCopy's operations, posing a significant risk to sensitive academic data and research. Institutions need to bolster their cybersecurity defenses to protect against such tailored attacks.

Sep 22, 2026

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

The Hacker News

A security vulnerability has been discovered in Meta's Muse assistant that could allow malware already on a Mac to hijack the assistant. Researcher Patrick Wardle demonstrated that by modifying a hidden setting, attackers could redirect voice commands meant for Muse to themselves. This means that any sensitive information users dictate could be intercepted by malicious actors. The issue stems from the broad permissions granted to the Muse app, which can be exploited if the malware is already present on the device. This incident raises concerns about the security of AI assistants and the potential for them to be weaponized against users.

Sep 22, 2026

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

The Hacker News

A recently discovered vulnerability in WordPress, known as 'Comment2Shell' and tracked as CVE-2026-93485, allows anonymous users to leave comments that can inject hidden scripts into web pages. If an administrator then views the page, the script can execute code on the server, potentially allowing attackers to take control of the site. This issue was addressed in version 7.1.1, released on September 17, 2023. Site owners are urged to update their WordPress installations immediately to protect against this flaw, which poses significant risks to website security. Failure to patch could leave sites vulnerable to remote code execution attacks.

Sep 22, 2026