[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fppP2D08Z1ISzRFFhmP-l-9MxHpImHrs--FeeN6E2T00":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"7776e4cf-5bd6-439c-99e7-9fa5757840a7","critical-linux-kvm-flaw-allows-guest-vms-to-escape-and-access-host-memory-on-arm64","7a30c154-b468-4902-81cb-5cacf8a5888b","Critical Linux KVM Flaw Allows Guest VMs to Escape and Access Host Memory on ARM64","A critical flaw in the Linux kernel's KVM virtualization layer for ARM64 processors (CVE-2026-89775) allows a malicious or compromised guest virtual machine to read and write directly to host kernel memory, effectively breaking the isolation boundary that hypervisors depend upon. This type of guest-to-host escape is among the most severe classes of virtualization vulnerabilities, as it can allow an attacker who controls a single tenant VM to compromise the entire host and every other VM running on it. The vulnerability is compounded by the fact that nested virtualization — a feature often enabled for development or cloud-on-cloud scenarios — expands the attack surface significantly. Because distribution-specific patch schedules vary, many production systems may remain exposed long after upstream fixes are available, widening the window of exploitation.","**Immediate actions:**\n- Apply the patched Linux kernel version as an emergency update on all ARM64 hosts running KVM, prioritizing multi-tenant and production hypervisors.\n- Disable nested virtualization (`kvm-intel.nested=0` \u002F `kvm.nested=0`) on any host where it is not strictly required until patching is confirmed complete.\n- Audit all virtualization hosts to identify which kernel versions are deployed and cross-reference against the affected version range for CVE-2026-89775.\n\n**Long-term improvements:**\n- Establish a formal emergency patching SLA (e.g., ≤24–72 hours) for Critical\u002FCVSS 9.0+ kernel vulnerabilities affecting hypervisor infrastructure.\n- Maintain a continuously updated software bill of materials (SBOM) and kernel version inventory across all virtualization hosts to accelerate impact scoping during future disclosures.\n- Enforce a policy of minimal feature enablement on hypervisors — disable nested virtualization, unused kernel modules, and non-essential KVM features by default.\n\n**Detection measures:**\n- Deploy kernel integrity monitoring (e.g., IMA\u002FEVM, Falco, or eBPF-based tools) to detect anomalous memory access patterns that could indicate exploitation attempts.\n- Integrate CVE feed subscriptions and automated alerting into your vulnerability management platform to receive real-time notification of kernel-level disclosures.\n- Perform regular vulnerability scans of hypervisor hosts using authenticated scanning tools capable of assessing installed kernel versions against known CVEs.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF PR.IP-12: Vulnerability Management Plan","ITIL: Change Management \u002F Emergency Change Procedures","ISO\u002FIEC 27001 Annex A.12.6.1: Management of Technical Vulnerabilities","PCI DSS Requirement 6.3: Security Vulnerabilities Identified and Addressed",{},"published","2026-09-22T12:21:00.828039+00:00","2026-09-22T12:21:00.549+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fnew-linux-kernel-flaw-gives-arm64-kvm.html","new-linux-kernel-flaw-gives-arm64-kvm-guests-read-write-access-to-host-memory-319e5d","New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"3bf292e9-4ce4-4448-beba-fca493e97883","2026-09-22","afternoon","ThreatNoir Afternoon Brief — September 22","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-22\u002Fthreatnoir-afternoon-brief-2026-09-22.mp3",[59,62,65],{"slug":36,"name":60,"problem":61},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":48,"name":63,"problem":64},"Automated patch management","Known holes get closed in days, not months.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]