Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for ARM64 systems. The issue occurs when the system performs memory address translations during specific error simulations or emulation tasks. If exploited, this could lead to system instability or crashes, potentially impacting the availability of virtualized services.
Technical details
A vulnerability in the Linux kernel's KVM implementation for arm64 architectures arises from a failure to acquire the Sleepable Read-Copy Update (SRCU) lock during certain page table walks. Specifically, the functions `__kvm_at_s12()` and `__kvm_find_s1_desc_level()` call into `walk_s1()` and `kvm_walk_nested_s2()` without proper synchronization. This lack of locking fails to guard against concurrent memslot changes, potentially leading to use-after-free scenarios or inconsistent memory states during Address Translation (AT) emulation and fault injection. The issue is resolved by acquiring `kvm->srcu` before performing the table walks.
Affected products
- Linux Linux Kernel 6.12, 6.18.36, 7.0.13
Timeline
- 2026-06-03: other: Vulnerability fixed in upstream commits
- 2026-06-25: disclosed: CVE published to NVD