{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46317","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-05-13T15:03:33.112Z","datePublished":"2026-06-09T11:52:30.333Z","dateUpdated":"2026-08-05T12:31:13.022Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:31:13.022Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm->arch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through KVM ioctls on /dev/kvm (KVM_CREATE_VCPU and KVM_ARM_VCPU_INIT), which drive kvm_vcpu_init_nested() while the MMU notifier path runs in the host kernel; this is a local syscall/ioctl attack surface, not a network protocol.\nAC:L - Exploitation is a race between KVM_ARM_VCPU_INIT reallocating nested_mmus and MMU notifier unmaps, and the attacker controls both sides by concurrently creating/initializing vCPUs and manipulating guest memory regions to trigger kvm_unmap_gfn_range().\nPR:L - The attacker needs access to /dev/kvm with nested virtualization enabled (KVM_ARM_VCPU_HAS_EL2), which a cloud tenant with nested-virt-capable AArch64 instances can obtain without host init-namespace root; this is not unauthenticated network access but is below full host administrator.\nUI:N - No victim interaction is required; the race can be driven entirely by the attacker's own KVM and memory-management ioctls from userspace.\nS:C - Successful exploitation corrupts host kernel memory from within a guest VM's KVM context, crossing the VM-to-hypervisor isolation boundary and enabling host kernel compromise (VM escape) on AArch64 cloud servers running nested virtualization.\nC:H - The freed nested_mmus array is a use-after-free; concurrent walkers under mmu_lock dereference kvm_s2_mmu structures and their page-table pointers, enabling arbitrary kernel memory disclosure.\nI:H - UAF on kvm_s2_mmu objects that contain kvm_pgtable pointers and stage-2 page-table state can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a benign crash.\nA:H - Concurrent access to the freed nested_mmus buffer during kvm_nested_s2_unmap() or related MMU walks can cause kernel oopses, panics, or hangs on the host."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/kvm/nested.c"],"versions":[{"version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","lessThan":"918450ad6010df6ecd2efde12a1409e011da22d6","status":"affected","versionType":"git"},{"version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","lessThan":"4424dbcb06d68e34e51c019a5781a7dc00731971","status":"affected","versionType":"git"},{"version":"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51","lessThan":"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/kvm/nested.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6"},{"url":"https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971"},{"url":"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}],"title":"KVM: arm64: Reassign nested_mmus array behind mmu_lock","x_generator":{"engine":"bippy-1.2.0"}}}}