{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n\nTwo bugs exist in the vCPU initialisation path:\n\n1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup\n   path jumps to \u0027unlock\u0027 without calling unpin_host_vcpu() or\n   unpin_host_sve_state(), permanently leaking pin references on the\n   host vCPU and SVE state pages.\n\n   Extract a register_hyp_vcpu() helper that performs the checks and\n   the store. When register_hyp_vcpu() returns an error, call\n   unpin_host_vcpu() and unpin_host_sve_state() inline before falling\n   through to the existing \u0027unlock\u0027 label.\n\n2. register_hyp_vcpu() publishes the new vCPU pointer into\n   \u0027hyp_vm-\u003evcpus[]\u0027 with a bare store, allowing a concurrent caller\n   of pkvm_load_hyp_vcpu() to observe a partially initialised vCPU\n   object.\n\n   Ensure the store uses smp_store_release() and the load uses\n   smp_load_acquire(). While \u0027vm_table_lock\u0027 currently serialises the\n   store and the load, these barriers ensure the reader sees the fully\n   initialised \u0027hyp_vcpu\u0027 object even if there were a lockless path or\n   if the lock\u0027s own ordering guarantees were insufficient for nested\n   object initialization."
    }
  ],
  "id": "CVE-2026-46147",
  "lastModified": "2026-05-28T13:44:01.663",
  "metrics": {},
  "published": "2026-05-28T10:16:30.320",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6d69c0ed978f7f0efd053fc98390f25ab77c1aea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7d3c27b54253cda91dc4d2c1bfc109c490837ab9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-46147"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-28T10:16:30Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n\nTwo bugs exist in the vCPU initialisation path:\n\n1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup\n   path jumps to \u0027unlock\u0027 without calling unpin_host_vcpu() or\n   unpin_host_sve_state(), permanently leaking pin references on the\n   host vCPU and SVE state pages.\n\n   Extract a register_hyp_vcpu() helper that performs the checks and\n   the store. When register_hyp_vcpu() returns an error, call\n   unpin_host_vcpu() and unpin_host_sve_state() inline before falling\n   through to the existing \u0027unlock\u0027 label.\n\n2. register_hyp_vcpu() publishes the new vCPU pointer into\n   \u0027hyp_vm-\u003evcpus[]\u0027 with a bare store, allowing a concurrent caller\n   of pkvm_load_hyp_vcpu() to observe a partially initialised vCPU\n   object.\n\n   Ensure the store uses smp_store_release() and the load uses\n   smp_load_acquire(). While \u0027vm_table_lock\u0027 currently serialises the\n   store and the load, these barriers ensure the reader sees the fully\n   initialised \u0027hyp_vcpu\u0027 object even if there were a lockless path or\n   if the lock\u0027s own ordering guarantees were insufficient for nested\n   object initialization.",
  "id": "GHSA-m978-f9gm-gj2j",
  "modified": "2026-05-28T12:30:30Z",
  "published": "2026-05-28T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46147"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d69c0ed978f7f0efd053fc98390f25ab77c1aea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7d3c27b54253cda91dc4d2c1bfc109c490837ab9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-46147 KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46147.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()",
    "tracking": {
      "current_release_date": "2026-05-29T01:07:53.000Z",
      "generator": {
        "date": "2026-05-29T07:23:45.807Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-46147",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-29T01:07:53.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46147",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "under_investigation": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-46147 KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46147.json"
        }
      ],
      "title": "KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()"
    }
  ]
}