---
id: CVE-2026-46317
title: 'KVM: arm64: Reassign nested_mmus array behind mmu_lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Reassign nested_mmus array behind mmu_lock

  kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the
  MMU notifier path (kvm_unmap_gfn_range…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 <
    918450ad6010df6ecd2efde12a1409e011da22d6
  - >-
    Linux >= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 <
    4424dbcb06d68e34e51c019a5781a7dc00731971
  - >-
    Linux >= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 <
    70543358fa08e0f7cebc3447c3b70fe97ad7aaa8
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:21:55.763760Z'
published: '2026-06-09'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:16.299Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46317'
references:
  - url: 'https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6'
  - url: 'https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971'
  - url: 'https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.01992
ingestedAt: '2026-10-16T17:24:46.716Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Reassign nested_mmus array behind mmu_lock

kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the
MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which
can run at any time. kvm_vcpu_init_nested() reallocates the array and frees
the old buffer while holding only kvm->arch.config_lock, so such a walker
can reference the freed array.

Allocate the new array outside of mmu_lock, as the allocation can sleep.
Under the lock, copy the existing entries, fix up the back pointers and
reassign the array. Free the old buffer after dropping the lock, as
kvfree() can sleep as well.

## Affected

- `Linux >= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 < 918450ad6010df6ecd2efde12a1409e011da22d6`
- `Linux >= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 < 4424dbcb06d68e34e51c019a5781a7dc00731971`
- `Linux >= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 < 70543358fa08e0f7cebc3447c3b70fe97ad7aaa8`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.