Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for ARM64 systems. Under specific conditions, the system fails to properly release memory references during a race condition. This can lead to a memory leak, which over time may degrade system performance or cause stability issues for the host operating system.
Technical details
A resource leak exists in arch/arm64/kvm/nested.c within the Linux kernel. The function kvm_translate_vncr() fails to release a reference on a faulted-in Page Frame Number (PFN) when it encounters a race condition with an MMU notifier. Specifically, when mmu_invalidate_retry() triggers an early return, the code does not call kvm_release_faultin_page(), leading to a reference leak. This issue affects ARM64 systems utilizing nested virtualization. Patches have been released for various stable branches including 6.18.39 and 7.1.4.
Affected products
- Linux Linux Kernel 6.16 to 6.18.39, 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory