In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We… (CVE-2026-98440)

The vulnerability in the Linux kernel's KVM arm64 component was due to freeing shadow Stage 2 structures prematurely within the kvm_arch_flush_shadow_all() callback. While freeing page tables at this point is appropriate, freeing the container structures that might still be referenced elsewhere is unsafe. The resolution introduces separate destructors that are invoked only during VM teardown, after vCPUs have been destroyed, allowing safe deallocation of individual MMUs and the global array referencing them.

The premature freeing of shadow S2 structures could potentially lead to use-after-free conditions or system instability within the KVM virtualization environment on arm64 architectures. However, no known exploits in the wild have been reported. The impact is limited to the internal memory management of virtual machines and could affect VM stability or security if exploited.

A fix has been implemented in the Linux kernel to delay freeing shadow S2 structures until VM destruction. Users should update to the fixed kernel version once available. Since this is a kernel-level fix, applying the official kernel update from the Linux distribution vendor is the recommended remediation.