cbcvebase.
CVE-2026-46317
published 2026-06-09

CVE-2026-46317: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked…

PriorityP342high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.13%
3.0th percentile
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which can run at any time. kvm_vcpu_init_nested() reallocates the array and frees the old buffer while holding only kvm->arch.config_lock, so such a walker can reference the freed array. Allocate the new array outside of mmu_lock, as the allocation can sleep. Under the lock, copy the existing entries, fix up the back pointers and reassign the array. Free the old buffer after dropping the lock, as kvfree() can sleep as well.

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 < 918450ad6010df6ecd2efde12a1409e011da22d6918450ad6010df6ecd2efde12a1409e011da22d6
linuxlinux>= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 < 4424dbcb06d68e34e51c019a5781a7dc007319714424dbcb06d68e34e51c019a5781a7dc00731971
linuxlinux>= 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 < 70543358fa08e0f7cebc3447c3b70fe97ad7aaa870543358fa08e0f7cebc3447c3b70fe97ad7aaa8
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 6.11 < 6.18.356.18.35
linuxlinux_kernel>= 6.19 < 7.0.127.0.12
ubuntulinux
ubuntulinux-aws
ubuntulinux-azure
ubuntulinux-azure-6.17
ubuntulinux-azure-fde
ubuntulinux-azure-fde-6.17
ubuntulinux-gcp
ubuntulinux-gcp-6.17
ubuntulinux-gke
ubuntulinux-hwe-7.0
ubuntulinux-ibm
ubuntulinux-oem-6.17

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.