KVM: arm64: Reassign nested_mmus array behind mmu_lock_CVE-2026-46317

8.8 / 10

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Reassign nested_mmus array behind mmu_lock

kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the
MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which
can run at any time. kvm_vcpu_init_nested() reallocates the array and frees
the old buffer while holding only kvm->arch.config_lock, so such a walker
can reference the freed array.

Allocate the new array outside of mmu_lock, as the allocation can sleep.
Under the lock, copy the existing entries, fix up the back pointers and
reassign the array. Free the old buffer after dropping the lock, as
kvfree() can sleep as well.

AI Analysis

Use-after-free vulnerability in KVM: arm64 due to incorrect handling of nested_mmus array behind mmu_lock

Basic Information

ID CVE-2026-46317

Source Linux

Published Jun 9, 2026 at 11:52

Modified Jun 14, 2026 at 04:30

Affected Product

Vendor Linux

Product Linux

Version 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51

Affected Versions Linux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
Linux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
Linux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51
Linux Linux 6.11

AI Assessment

AI Score 8.8 / 10

AI Severity High

Vendor Linux

Product Linux Kernel

Version 6.11, 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51

References

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm->arch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well.",
    "published": "2026-06-09T11:52:30.333Z",
    "modified": "2026-06-14T04:30:12.036Z",
    "type": "cve",
    "title": "KVM: arm64: Reassign nested_mmus array behind mmu_lock",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6\nhttps://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971\nhttps://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8",
    "id": "CVE-2026-46317",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "Linux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51\nLinux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51\nLinux Linux 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51\nLinux Linux 6.11",
    "sourceHref": "",
    "cvss": {
        "score": 8.8,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
    "vendor": "Linux",
    "ai_description": "Use-after-free vulnerability in KVM: arm64 due to incorrect handling of nested_mmus array behind mmu_lock",
    "ai_severity": "High",
    "ai_vendor": "Linux",
    "ai_product": "Linux Kernel",
    "ai_version": "6.11, 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
    "ai_score": 8.8
}