A Critical Vulnerability in Linux Kernel Exposes ARM64 KVM Guests to Host Memory Attacks
A newly discovered flaw in the Linux kernel has left thousands of users vulnerable to a potentially devastating attack. The vulnerability, which affects systems running on ARM64 architecture with Kernel-based Virtual Machine (KVM) enabled, allows malicious code executed within a virtual machine to access and modify sensitive data on the host system.
The issue arises from an error in the way KVM handles memory allocation for guest operating systems. When a KVM guest is created, it is assigned a portion of the host’s physical memory, known as a “guest page.” However, due to a bug in the kernel’s memory management code, a malicious guest can manipulate its own page tables to gain access to any location within the host’s memory space. This effectively grants the guest read and write access to sensitive data stored on the host system.
The vulnerability affects systems running Linux distributions that utilize KVM for virtualization, including Ubuntu, Debian, and CentOS. According to estimates, thousands of servers and cloud instances are potentially exposed to this threat, with many more users likely affected in various other contexts. The severity of the issue is compounded by the fact that an attacker need only execute malicious code within a single guest operating system to compromise the entire host.
One of the most concerning aspects of this vulnerability is its potential for lateral movement and data exfiltration. Once an attacker gains access to the host’s memory, they can move freely between virtual machines and other processes running on the system, allowing them to exploit multiple vulnerabilities and breach sensitive data. This could have significant implications for organizations that rely on KVM-based virtualization for their cloud infrastructure.
The discovery of this vulnerability highlights the ongoing struggle to secure complex systems in a rapidly evolving threat landscape. As more users transition to virtualized environments, it is crucial that they stay informed about potential security risks and take proactive measures to mitigate them. In light of this discovery, we recommend that administrators running KVM-enabled Linux distributions on ARM64 architecture immediately update their kernel and review their system’s memory allocation settings to prevent unauthorized access.
In the face of such vulnerabilities, vigilance is key. Regularly updating your systems, monitoring for suspicious activity, and conducting thorough risk assessments can help you stay ahead of emerging threats. By staying informed and proactive in your security measures, you can minimize the impact of these types of flaws on your organization’s overall security posture.
Source: The Hacker News — 2026-09-22