CVE-2026-46317
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
09/06/2026
Last modified:
23/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
KVM: arm64: Reassign nested_mmus array behind mmu_lock<br />
<br />
kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the<br />
MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which<br />
can run at any time. kvm_vcpu_init_nested() reallocates the array and frees<br />
the old buffer while holding only kvm->arch.config_lock, so such a walker<br />
can reference the freed array.<br />
<br />
Allocate the new array outside of mmu_lock, as the allocation can sleep.<br />
Under the lock, copy the existing entries, fix up the back pointers and<br />
reassign the array. Free the old buffer after dropping the lock, as<br />
kvfree() can sleep as well.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.18.35 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.12 (excluding) |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page