Linux KVM arm64: page-table walks without kvm->srcu can race memslot changes

Impact

walk_s1() and kvm_walk_nested_s2() must run under kvm->srcu so the memslot array cannot change underneath them, but __kvm_at_s12() and __kvm_find_s1_desc_level() called them without taking it. A guest that drives the AT (address translation) emulation or fault-injection paths while the VMM updates memslots can race the walker against a freed or replaced memslot, which is a use-after-free class bug in host kernel context - NVD rates it local, low-privilege, with scope change and full host impact. This only affects arm64 KVM hosts, so it matters on Grace-class and other Arm GPU nodes that run tenant VMs, and is irrelevant on x86 hosts and on nodes that do not run KVM at all. Where it does apply the blast radius is the hypervisor, so one tenant VM on a shared Arm GPU host is the starting position.

Who can reach it

Local: a guest running on an arm64 KVM host, i.e. any tenant who can boot a VM on that node. No host credentials needed; not reachable over the network and not reachable on hosts that do not expose KVM to tenants.

What to do

Take the stable kernel fix (commits 9770609, ec42b4e, f2ca45b) or the distro update - Red Hat ships it as RHSA-2026:64775 - then drain each affected arm64 hypervisor node and reboot into the new kernel. There is no configuration mitigation inside KVM; the practical interim step is to not schedule untrusted tenant VMs on unpatched arm64 hosts. x86-only fleets can skip the maintenance window entirely.

References

Related entries

• Linux kernel (drivers/iommu/intel): When the PASID is not found on the device list, VT-d runs the teardown anyway andCVE-2026-53281 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (drivers/vfio/pci): When a tenant closes its passed-through PCI device, vfio disables the function beforeCVE-2026-53322 · Linux kernel (drivers/vfio/pci)High
• Linux kernel (arch/x86/kvm/mmu): Shadow-page lookup reuses a page without comparing its role, so a direct (2MB) shadowCVE-2026-53359 · Linux kernel (arch/x86/kvm/mmu)High
• Linux KVM - GHCB v2+ scratch area location enforcement: KVM did not require the GHCB software scratch area to liveCVE-2026-53360 · Linux KVM - GHCB v2+ scratch area location enforcementHigh
• PREVAIL: ALU32 arithmetic on pointers passes verification but truncates the pointer at runtimeCVE-2026-53706 · PREVAIL eBPF verifier (ALU32 ADD/SUB on pointer registers)High
• Linux kernel (arch/x86/kvm/mmu): A guest that creates a hugepage mapping extending below the bounds of a memslot makesCVE-2026-63807 · Linux kernel (arch/x86/kvm/mmu)High