CVE-2026-46317

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-46317

Key Details

CVE	CVE-2026-46317
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Reassign nested_mmus array behind mmu_lock

kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the

MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which

can run at any time. kvm_vcpu_init_nested() reallocates the array and frees

the old buffer while holding only kvm->arch.config_lock, so such a walker

can reference the freed array.

Allocate the new array outside of mmu_lock, as the allocation can sleep.

Under the lock, copy the existing entries, fix up the back pointers and

reassign the array. Free the old buffer after dropping the lock, as

kvfree() can sleep as well. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-46317
CVE	https://www.cve.org/CVERecord?id=CVE-2026-46317

Source

Reference

NVD

CVE