CVE-2026-46317 (GCVE-0-2026-46317)

Vulnerability from cvelistv5 – Published: 2026-06-09 11:52 – Updated: 2026-08-05 12:31
VLAI
Title
KVM: arm64: Reassign nested_mmus array behind mmu_lock
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which can run at any time. kvm_vcpu_init_nested() reallocates the array and frees the old buffer while holding only kvm->arch.config_lock, so such a walker can reference the freed array. Allocate the new array outside of mmu_lock, as the allocation can sleep. Under the lock, copy the existing entries, fix up the back pointers and reassign the array. Free the old buffer after dropping the lock, as kvfree() can sleep as well.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < 918450ad6010df6ecd2efde12a1409e011da22d6 (git)
Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < 4424dbcb06d68e34e51c019a5781a7dc00731971 (git)
Affected: 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 , < 70543358fa08e0f7cebc3447c3b70fe97ad7aaa8 (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "918450ad6010df6ecd2efde12a1409e011da22d6",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "4424dbcb06d68e34e51c019a5781a7dc00731971",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            },
            {
              "lessThan": "70543358fa08e0f7cebc3447c3b70fe97ad7aaa8",
              "status": "affected",
              "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm-\u003earch.nested_mmus[] is walked under kvm-\u003emmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -\u003e kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm-\u003earch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through KVM ioctls on /dev/kvm (KVM_CREATE_VCPU and KVM_ARM_VCPU_INIT), which drive kvm_vcpu_init_nested() while the MMU notifier path runs in the host kernel; this is a local syscall/ioctl attack surface, not a network protocol.\nAC:L - Exploitation is a race between KVM_ARM_VCPU_INIT reallocating nested_mmus and MMU notifier unmaps, and the attacker controls both sides by concurrently creating/initializing vCPUs and manipulating guest memory regions to trigger kvm_unmap_gfn_range().\nPR:L - The attacker needs access to /dev/kvm with nested virtualization enabled (KVM_ARM_VCPU_HAS_EL2), which a cloud tenant with nested-virt-capable AArch64 instances can obtain without host init-namespace root; this is not unauthenticated network access but is below full host administrator.\nUI:N - No victim interaction is required; the race can be driven entirely by the attacker\u0027s own KVM and memory-management ioctls from userspace.\nS:C - Successful exploitation corrupts host kernel memory from within a guest VM\u0027s KVM context, crossing the VM-to-hypervisor isolation boundary and enabling host kernel compromise (VM escape) on AArch64 cloud servers running nested virtualization.\nC:H - The freed nested_mmus array is a use-after-free; concurrent walkers under mmu_lock dereference kvm_s2_mmu structures and their page-table pointers, enabling arbitrary kernel memory disclosure.\nI:H - UAF on kvm_s2_mmu objects that contain kvm_pgtable pointers and stage-2 page-table state can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a benign crash.\nA:H - Concurrent access to the freed nested_mmus buffer during kvm_nested_s2_unmap() or related MMU walks can cause kernel oopses, panics, or hangs on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:13.022Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971"
        },
        {
          "url": "https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"
        }
      ],
      "title": "KVM: arm64: Reassign nested_mmus array behind mmu_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46317",
    "datePublished": "2026-06-09T11:52:30.333Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:13.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46317",
      "date": "2026-08-07",
      "epss": "0.0013",
      "percentile": "0.0301"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46317\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-09T13:16:37.000\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\\n\\nkvm-\u003earch.nested_mmus[] is walked under kvm-\u003emmu_lock, including from the\\nMMU notifier path (kvm_unmap_gfn_range() -\u003e kvm_nested_s2_unmap()), which\\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\\nthe old buffer while holding only kvm-\u003earch.config_lock, so such a walker\\ncan reference the freed array.\\n\\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\\nUnder the lock, copy the existing entries, fix up the back pointers and\\nreassign the array. Free the old buffer after dropping the lock, as\\nkvfree() can sleep as well.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nKVM: arm64: Reasignar el array nested_mmus detr\u00e1s de mmu_lock\\n\\nkvm-\u003earch.nested_mmus[] es recorrido bajo kvm-\u003emmu_lock, incluyendo desde la ruta del notificador de MMU (kvm_unmap_gfn_range() -\u003e kvm_nested_s2_unmap()), que puede ejecutarse en cualquier momento. kvm_vcpu_init_nested() reasigna el array y libera el b\u00fafer antiguo mientras mantiene solo kvm-\u003earch.config_lock, por lo que dicho recorredor puede referenciar el array liberado.\\n\\nAsignar el nuevo array fuera de mmu_lock, ya que la asignaci\u00f3n puede dormir. Bajo el bloqueo, copiar las entradas existentes, corregir los punteros inversos y reasignar el array. Liberar el b\u00fafer antiguo despu\u00e9s de soltar el bloqueo, ya que kvfree() tambi\u00e9n puede dormir.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kvm/nested.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51\",\"lessThan\":\"918450ad6010df6ecd2efde12a1409e011da22d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51\",\"lessThan\":\"4424dbcb06d68e34e51c019a5781a7dc00731971\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f128f8e1aaac189f83d0f828bcdb2986d8d2e51\",\"lessThan\":\"70543358fa08e0f7cebc3447c3b70fe97ad7aaa8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kvm/nested.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.18.35\",\"matchCriteriaId\":\"CB828803-5FA4-4A1C-A77D-0A10A2BAFDC6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.12\",\"matchCriteriaId\":\"9161A938-0FA8-44BC-95FE-C5A271601AB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:45:26+00:00",
      "cve": "CVE-2026-46317",
      "id": "CVE-2026-46317",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46317.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.