CVE-2026-98927: KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix life cycle of the nestedmmus array

The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which implies that they may have to be relocated as the array grows.

Should a VCPUINIT occur whilst a vcpu is actively running an L2 and that the allocation requires relocation, that vcpu will still be running with a pointer to the previous structure, which will have been freed.

Fix this by turning the array of structures to an array of pointers, which is now allocated at VM creation, sized to the absolute maximum that KVM can handle.

In turn, each VCPUINIT contributes S2MMUPERVCPU to the pool. No reallocation is ever performed, and the life cycle of each object is much clearer:

- the nestedmmus array is allocated in kvminitnested(), and freed in kvmarchdestroyvm()

- s2mmu structures are allocated in kvmvcpuinitnested(), and freed on kvmarchflushshadowall()

Finally, the freeing of vcpu->arch.vncrarray is made consistent rather than being done on some failure paths, but not others.