In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array… (CVE-2026-98927)

The Linux kernel vulnerability CVE-2026-98927 concerns the nested_mmus array in the KVM arm64 nested virtualization code. The nested_mmus array stores shadow page tables for nested guests and was originally allocated during VCPU_INIT for the entire guest, requiring potential relocation as it grows. If relocation occurred while a vCPU was running an L2 guest, the vCPU could reference a freed structure, causing a use-after-free issue. The fix replaces the array of structures with an array of pointers allocated once at VM creation, sized to the maximum KVM can handle, eliminating the need for reallocation. This change improves lifecycle management by allocating nested_mmus in kvm_init_nested() and freeing them in kvm_arch_destroy_vm(), and similarly managing s2_mmu structures. Additionally, freeing of vcpu->arch.vncr_array was made consistent across failure paths.

The vulnerability could lead to use-after-free conditions in the nested virtualization code on arm64 architectures, potentially causing kernel crashes or memory corruption. This impacts the stability and security of nested virtual machines running on affected Linux kernels. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by changing the nested_mmus array management to avoid reallocations and use-after-free conditions. Users should update to the Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.