Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for ARM64 systems. The issue involves a race condition where the system might try to access memory that has already been freed during the management of virtual machines. If exploited, this could lead to a system crash or unpredictable behavior, impacting the stability and availability of the host server.
Technical details
A race condition exists in arch/arm64/kvm/nested.c within the Linux kernel. The kvm->arch.nested_mmus[] array is walked under the kvm->mmu_lock (e.g., during MMU notifier paths like kvm_unmap_gfn_range()), but kvm_vcpu_init_nested() was reallocating and freeing this array while only holding the kvm->arch.config_lock. This allows a concurrent walker to reference the array after it has been freed. The fix involves performing the allocation outside the lock, then performing the array reassignment and pointer fixups while holding the write_lock for kvm->mmu_lock. Patches have been merged into the stable kernel branches.
Affected products
- Linux Linux Kernel arm64 architecture with KVM virtualization
Timeline
- 2026-06-05: patched: Initial patch authored by Hyunwoo Kim
- 2026-06-09: disclosed: CVE published in NVD dataset