CVE-2026-89775: Linux KVM ARM64 Guest-Escape via Use-After-Free

Tue, 22 Sep 2026 15:30:54 +0000

Engineer — Act: A public PoC on GitHub for a guest-to-host escape on ARM64 KVM hosts with nested virtualization enabled demands immediate attention: patch the Linux kernel to the fixed version and, where nested virtualization is not required, disable it now to remove the attack surface.
SOC/IR — Learn: No active exploitation is reported and EPSS is effectively zero, so there is no detection action to take today; however, understanding the KVM guest-escape technique is worth filing for future hunt hypothesis development should exploitation emerge.
Leader — Skip
Signals: CVE-2026-89775 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub

Guest-Escape on CuraSec