The Linux kernel's KVM arm64 code improperly handled the nested_mmus array by reallocating and freeing it while holding only the config_lock, whereas the array is accessed under the mmu_lock, including from asynchronous MMU notifier paths. This mismatch could lead to use-after-free conditions when the array is walked concurrently. The fix involves allocating the new array outside the mmu_lock to avoid sleeping under the lock, copying entries and fixing back pointers under the lock, reassigning the array, and freeing the old buffer after releasing the lock to prevent sleeping while locked.

This vulnerability allows a local attacker with limited privileges to cause use-after-free conditions in the KVM subsystem on arm64 architectures, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates high impact on all three security properties.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended mitigation.