CVE-2026-46317: KVM: arm64: Reassign nested_mmus array behind mmu_lock

Synopsis

A use-after-free vulnerability in the Linux kernel's KVM arm64 hypervisor component allows a local attacker with a low-privilege account to corrupt memory by triggering a race condition between the MMU notifier path and the nested MMU array reallocation in kvm_vcpu_init_nested(). The flaw is reachable locally and requires no user interaction. Successful exploitation gives an attacker full read, write, and crash capability over the affected host or guest environment. Patched-image rebuilds at the fix versions (6.18.35, 7.0.12, and 7.1-rc7) are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable KVM code path.

• Victim interactionNot required

  No victim action is needed; the attacker can trigger the race condition independently.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions are required beyond local access; the race window between the MMU notifier path and the nested MMU array reallocation is the only timing factor.

Blast Radius

• Reads arbitrary kernel memory, including host credentials, guest secrets, and stored session tokens.
• Writes to freed or reallocated kernel memory, allowing corruption of hypervisor data structures and guest VM state.
• Crashes the host kernel or a guest VM by corrupting the nested_mmus array, causing a denial of service for all workloads on the affected node.
• Escalates privileges from a low-privilege local account to full kernel-level control due to the scope-changed (S:C) CVSS rating.