KVM arm64: nested_mmus array reallocated outside mmu_lock, leaving MMU-notifier walkers on freed memory

Impact

kvm_vcpu_init_nested() reallocated kvm->arch.nested_mmus[] and freed the old buffer while holding only config_lock, but the array is walked under mmu_lock - including from the MMU-notifier path via kvm_unmap_gfn_range() -> kvm_nested_s2_unmap(), which can fire at any time. A guest that triggers nested MMU initialization while host memory management is unmapping pages gets the host dereferencing a freed array: use-after-free in the host hypervisor, with the recorded scope change that implies a guest-to-host crossing. On Arm GPU hosts (Grace-based nodes and similar) running nested virtualization for tenants, the worst case is host compromise or a hypervisor crash that loses every VM and every GPU job on the node. The exposure is narrow: only configurations with KVM arm64 nested virtualization enabled reach this code, and NV is still a young feature that most fleets do not turn on.

Who can reach it

Local on the host, from inside a guest: a tenant VM on an arm64 KVM host with nested virtualization enabled that can cause vCPU nested-MMU init. Requires only normal guest-level privilege, no host credentials. Hosts without arm64 NV are not affected.

What to do

Update to a stable kernel with the linked fix (allocate outside mmu_lock, copy and reassign under it, free after dropping it) and reboot the hypervisor. If you cannot patch promptly, disabling KVM arm64 nested virtualization removes the path - that still means restarting guests. Either way drain the node first.

References

Related entries

• Linux kernel (drivers/iommu): The IOMMU group's domain pointer is left stale when a device reset races a detach, andCVE-2026-52952 · Linux kernel (drivers/iommu)High
• Linux kernel (drivers/iommu/amd): On AMD hosts the Device Table Entry copied to a DMA-alias device is looked up usingCVE-2026-53053 · Linux kernel (drivers/iommu/amd)High
• Linux kernel (drivers/iommu/riscv): The RISC-V IOMMU driver updated device-directory and process-directory entriesCVE-2026-53057 · Linux kernel (drivers/iommu/riscv)High
• Linux kernel (net/xfrm): An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socketCVE-2026-53240 · Linux kernel (net/xfrm)High
• Linux KVM arm64: page-table walks without kvm->srcu can race memslot changesCVE-2026-53277 · Linux kernel KVM arm64 (__kvm_at_s12 / __kvm_find_s1_desc_level page-table walks)High
• Linux kernel (drivers/iommu/intel): When the PASID is not found on the device list, VT-d runs the teardown anyway andCVE-2026-53281 · Linux kernel (drivers/iommu/intel)High