Cloud security rests on one promise above all others: whatever happens inside a customer's virtual machine stays there.
CVE-2026-89775 breaks that promise.
The vulnerability sits in KVM's ARM64 code and affects hosts running nested virtualisation. According to the researcher who disclosed it, a flaw in the way KVM handles a stage-1 page-table walk can leave a freed host page mapped into the attacking guest. The guest then gets 64-bit read and write access to that page without a trap or VM exit. The researcher describes it plainly as a guest-to-host escape.
There are prerequisites. Nested virtualisation has to be enabled. That limits the number of immediately exposed systems, and it is worth saying because security reporting becomes useless when every serious vulnerability is described as universal.
It also does very little to make the bug comfortable.
A tenant-controlled VM can retain writable access to memory after the host thinks that memory has been reclaimed. Once that happens, the abstraction separating guest from host has already failed.
A zero where there should not have been one
The bug itself is almost comically small compared with the damage it can cause.
When ARM's stage-1 MMU is disabled, KVM represents the walk level with a negative sentinel value. The affected code mishandles that value while calculating the size of a TLB invalidation. The calculation winds up producing zero. KVM then skips an invalidation that should have happened.
The host is free to recycle the physical page. The guest still has the mapping.
From the host's point of view, ownership changed. From the processor's point of view, the old guest can still reach the memory.
Hypervisors cannot afford that disagreement.
Ubuntu gives the CVE a 9.3 CVSS score, although its operational priority is Medium. That apparent contradiction is useful. Exploitability depends on the environment, while successful exploitation gives an attacker a very powerful primitive.
The distinction between reach and impact matters for defenders. It should not become an excuse to downgrade what happened.
A vulnerability that lets an untrusted guest write into host memory has crossed one of the hardest security boundaries in modern computing.
ARM64 is carrying more valuable workloads
A few years ago, an ARM64 KVM escape would have looked important mainly to kernel developers and specialised infrastructure teams.
ARM servers now sit much closer to the centre of cloud computing.
AI has accelerated that change. Providers are packing expensive accelerators behind virtual machines, containers, microVMs and increasingly elaborate isolation layers. Coding agents need somewhere to execute commands. Reinforcement-learning systems need disposable environments. Hosted development tools routinely run code their operators did not write.
That makes virtualisation security part of AI infrastructure security.
The industry talks constantly about whether an autonomous model might run a dangerous command. Less attention goes to the machinery responsible for containing that command after it runs.
A perfectly aligned model is an unrealistic security assumption. So is a bug-free agent. The isolation underneath the agent has to survive both deliberate attacks and ordinary mistakes.
CVE-2026-89775 is therefore more than an embarrassing kernel arithmetic error. It is a reminder that the AI stack is inheriting every old systems problem beneath it, then multiplying the value of whatever sits on the other side of the boundary.
A compromised web server used to expose a web server.
A compromised host in a dense AI cluster may expose model weights, credentials, customer workloads, proprietary training data or access to costly accelerator infrastructure.
The payoff for crossing the hypervisor is getting larger.
Cloud providers should resist the easy reassurance
Public exposure is uneven. The vulnerability specifically involves nested virtualisation, and not every ARM cloud offering exposes that configuration. That sharply affects the immediate blast radius.
The wrong conclusion would be that ARM64 KVM escapes remain an edge case.
Infrastructure has a habit of turning yesterday's optional feature into tomorrow's production dependency. Nested virtualisation becomes attractive whenever somebody wants to create an isolated machine inside an already virtualised service. Agent sandboxes, developer environments and security products all pull in that direction.
More layers solve operational problems. They also create more state that has to remain consistent.
Page ownership, translation tables and invalidations sound like plumbing until one stale entry lets a guest keep touching memory that belongs to the host.
The patch fixes this bug. It does not remove the pressure pushing cloud architecture towards increasingly complicated isolation stacks.
ARM64 is getting more important. Autonomous workloads are getting more aggressive. Multi-tenant compute is getting denser.
That combination gives hypervisor mistakes a larger blast radius than they used to have.
For the AI cloud, the lesson from CVE-2026-89775 is fairly simple: sandboxing is only as trustworthy as the lowest layer enforcing it. If a guest can keep a host page after the hypervisor believes it has taken it away, everything built above that boundary inherits the mistake.