Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Reassign nested_mmus array behind mmu_lock
kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the
MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which
can run at any time. kvm_vcpu_init_nested() reallocates the array and frees
the old buffer while holding only kvm->arch.config_lock, so such a walker
can reference the freed array.
Allocate the new array outside of mmu_lock, as the allocation can sleep.
Under the lock, copy the existing entries, fix up the back pointers and
reassign the array. Free the old buffer after dropping the lock, as
kvfree() can sleep as well.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.11 | 6.18.35 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.0.12-1 | — |
| Debian 13 | linux | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | linux | 7.0.0-28.28 | USN-8566-1 |
| Ubuntu 26.04 LTS | linux-aws +2 | 7.0.0-1009.9 | USN-8618-1, USN-8603-1, USN-8568-1 |
| Ubuntu 26.04 LTS | linux-gcp +1 | 7.0.0-1008.8 | USN-8593-1, USN-8566-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1003.4 | USN-8566-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1010.10 | USN-8603-1, USN-8593-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1016.16 | USN-8663-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2016.16 | USN-8664-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1015.15 | USN-8618-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-28.28.1 | USN-8566-1 |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-azure-6.17 | 6.17.0-1021.21~24.04.1 | USN-8604-1 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1014.14~24.04.1 | USN-8728-2 |
| Ubuntu 24.04 LTS | linux-azure-fde-6.17 | 6.17.0-1018.18~24.04.1 | USN-8605-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1013.13~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1021.24~24.04.1 | USN-8570-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 +1 | 7.0.0-1011.11~24.04.1 | USN-8728-3, USN-8728-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-41.41~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-28.28~24.04.1 | USN-8569-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1031.31 | USN-8669-1 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1016.16~24.04.1 | USN-8663-1 |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1030.30 | USN-8594-1 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1019.19~24.04.3 | USN-8570-2 |
| Ubuntu 24.04 LTS | linux-riscv +20 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-28.28.1~24.04.3 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1018.20~24.04.1 | USN-8570-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-211.61.1.el10_2 | RHSA-2026:72624 |
| RHEL 9 | rv +75 | 5.14.0-687.55.1.el9_8 | RHSA-2026:76739 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.61.1.el10_2 | ALSA-2026:72624 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-211.61.1.el10_2 | RLSA-2026:72624 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.35.1 | SUSE-SU-2026:22127-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | SUSE-SU-2026:22127-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.35.1 | SUSE-SU-2026:22127-1, SUSE-SU-2026:22099-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | SUSE-SU-2026:22127-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | SUSE-SU-2026:22112-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.35.1 | SUSE-SU-2026:22117-1, SUSE-SU-2026:22112-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.0.12-1.1 | openSUSE-SU-2026:11014-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.35.1.160000.2.16 | openSUSE-SU-2026:20965-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.35.1 | openSUSE-SU-2026:20965-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.35-68.127 | 1:1.0-0.amzn2023 | ALAS2023-2026-1881 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.35-68.127.amzn2023 | ALAS2023-2026-1881 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-211.61.1.el10_2 | ELSA-2026-72624 |
| Oracle Linux 9 | rv +28 | 5.14.0-687.56.1.el9_8 | ELSA-2026-76739 |
Advisories 31
- RHSA-2026:76739 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:72624 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-1870 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8728-1 linux-gcp-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8728-2 linux-azure-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8728-3 linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8593-1 linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8664-1 linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8603-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8663-1 linux-nvidia, linux-nvidia-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8618-1 linux-aws, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8566-1 linux, linux-gcp, linux-gke, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8569-1 linux-hwe-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8604-1 linux-azure-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8568-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8669-1 linux-nvidia-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8570-1 linux-gcp-6.17, linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8570-2 linux-oracle-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8594-1 linux-oem-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- ALSA-2026:72624 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8605-1 linux-azure-fde-6.17 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- ELSA-2026-76739 Important: kernel security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 11, 2026
- RLSA-2026:72624 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 30, 2026
- ELSA-2026-72624 Important: kernel security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 29, 2026
- ALAS2023-2026-1881 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 12, 2026
- SUSE-SU-2026:22117-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:20965-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22127-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- SUSE-SU-2026:22112-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- SUSE-SU-2026:22099-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jun 17, 2026
- openSUSE-SU-2026:11014-1 kernel-devel-7.0.12-1.1 on GA media SUSE / openSUSE Security Updates · Jun 13, 2026