This vulnerability is a race condition in the ARM64 KVM implementation of the Linux kernel. When the nested_mmus array is reallocated under kvm->arch.config_lock, the array is freed before the mmu_lock is released. Simultaneously, other code paths may walk the same array while holding kvm->mmu_lock. If this occurs, the walker can read freed memory, causing a use‑after‑free that can corrupt critical kernel data structures. The resulting corruption can trigger a kernel crash or potentially allow an attacker to gain code execution from kernel space.

All Linux kernels running on ARM64 that have KVM enabled are affected. This includes every distribution that ships a recent Linux kernel with nested paging support for KVM on ARM64. Any system that loads one of these kernels and creates a virtual machine with nested paging enabled is vulnerable.

The CVSS score of 8.8 indicates high severity, and the EPSS score of < 1 % suggests a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The description implies that a malicious guest could potentially trigger the race by executing code inside the guest and racing the reallocation timing. While the exact exploit is not publicly documented, the inferred attack vector is a guest‑initiated race condition that could lead to a host crash or privilege escalation. This makes the risk significant for environments that run untrusted virtual machines.