CVE-2026-46317: KVM: arm64: Reassign nested_mmus array behind mmu_lock
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Reassign nestedmmus array behind mmulock
kvm->arch.nestedmmus[] is walked under kvm->mmulock, including from the MMU notifier path (kvmunmapgfnrange() -> kvmnesteds2unmap()), which can run at any time. kvmvcpuinitnested() reallocates the array and frees the old buffer while holding only kvm->arch.configlock, so such a walker can reference the freed array.
Allocate the new array outside of mmulock, as the allocation can sleep. Under the lock, copy the existing entries, fix up the back pointers and reassign the array. Free the old buffer after dropping the lock, as kvfree() can sleep as well.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46317?
The severity of CVE-2026-46317 is rated at 28.
How do I fix CVE-2026-46317?
To address CVE-2026-46317, apply the latest updates available for the Linux kernel that include the fix.
What platforms are affected by CVE-2026-46317?
CVE-2026-46317 affects the KVM component in the arm64 architecture of the Linux kernel.
Can CVE-2026-46317 lead to security breaches?
Yes, CVE-2026-46317 can potentially allow for security breaches if not mitigated by applying the appropriate patches.
When was CVE-2026-46317 published?
CVE-2026-46317 was published on June 9, 2026.