CVE-2026-46317: Linux Kernel ARM64 KVM Use-After-Free in Nested Virtualization

Technical summary

CVE-2026-46317 is a use-after-free vulnerability in the Linux kernel's KVM nested virtualization implementation for ARM64 platforms. The root cause is a synchronization gap: the kvm->arch.nested_mmus[] array is accessed under kvm->mmu_lock (including from the MMU notifier path kvm_unmap_gfn_range() → kvm_nested_s2_unmap()), but reallocation in kvm_vcpu_init_nested() freed the old buffer while holding only kvm->arch.config_lock. This creates a window where walkers of the array can dereference freed memory. The fix involves allocating the new array outside the lock (since allocation can sleep), copying entries and updating back pointers under mmu_lock, and deferring kvfree() of the old buffer until after the lock is released.

Business impact

An attacker with local system access can trigger a kernel panic or memory corruption on virtualization-enabled ARM64 Linux systems. In production environments running KVM with nested virtualization, this could result in denial of service to hosted virtual machines or, in worst-case scenarios, potential privilege escalation to ring-0 kernel context. Organizations using ARM64 servers for cloud computing or virtualized workloads face availability and confidentiality risks. The impact is heightened in multi-tenant environments where one tenant could disrupt others.

Affected systems

Linux kernel systems on ARM64 architecture with KVM nested virtualization enabled. This typically affects cloud providers, data centers, and systems running Kubernetes or OpenStack on ARM64 hardware. Consumer and enterprise systems using ARM64 Linux (including some Raspberry Pi clusters, Graviton-based AWS instances, and Ampere systems) are vulnerable if they expose nested virtualization capabilities to untrusted users or run untrusted workloads.

Exploitability

Exploitability is moderate to high within its scope. An attacker requires local user-level access to the system (PR:L in CVSS), meaning they must already have a non-root account or ability to execute code as a regular user. No special privileges are needed; the vulnerability is triggered through normal KVM operations (e.g., launching nested VMs). Exploitation does not require user interaction and is deterministic—repeatedly creating and destroying nested VMs can reliably trigger the race. However, the vulnerability is not in the CISA KEV catalog, suggesting active exploitation in the wild is not yet documented. The race window is narrow but exploitable through repeated attempts.

Remediation

Apply the upstream Linux kernel patch that fixes the synchronization issue by reordering the allocation, copy, and deallocation operations relative to mmu_lock. Systems should upgrade to a patched kernel version. Until patching is possible, mitigations include disabling nested virtualization (nesting=N module parameter for KVM on ARM64) if not required, restricting KVM access to trusted users only via cgroup or SELinux policies, and running workloads in containers with reduced privilege. However, these are temporary measures; kernel update is essential for a permanent fix.

Patch guidance

Kernel vendors and distributions should have released patched versions by late 2026. Check your distribution's security advisories for arm64-specific kernel updates. Verify patch availability through your vendor's security portal (e.g., Red Hat, Ubuntu, Debian). The upstream Linux repository should contain the fix in mainline. For systems on extended support cycles, backport patches may be released separately. Test patches in a non-production KVM environment first, as kernel updates require reboot and may affect live VMs.

Detection guidance

Monitor kernel logs for use-after-free warnings (UAF) or general protection faults triggered during nested VM creation/destruction. Enable kernel address sanitizer (KASAN) or similar debugging tools in test environments to catch the memory violation early. In production, watch for unexplained KVM guest crashes, particularly when nested virtualization is in active use. Network-based detection is not applicable; this is a local kernel issue. Security teams should correlate VM failures with timestamps of nested VM lifecycle events (creation, migration, destruction).

Why prioritize this

With a CVSS score of 8.8 (HIGH) and access requiring only local user privileges, this vulnerability poses significant risk to multi-tenant and virtualization-heavy deployments. The use-after-free nature makes it a potential vector for privilege escalation or reliable denial of service. Although not yet in CISA's KEV catalog, the combination of high severity, local exploitability, and production impact on ARM64 virtualization infrastructure warrants prompt patching. Prioritize systems running production KVM workloads, cloud infrastructure, and container orchestration platforms on ARM64.

Risk score, explained

The CVSS 8.8 score reflects: (1) local attack vector, reducing but not eliminating risk; (2) low complexity—race conditions are straightforward to trigger; (3) low privilege requirement—any user can exploit; (4) no user interaction needed; (5) scope change—the crash affects not just the attacker's VM but the host kernel and sibling VMs; (6) high impact on confidentiality, integrity, and availability through memory corruption and kernel panic. The score is NOT 9+ only because it requires local presence, but within that constraint, the risk is severe.

Frequently asked questions