The vulnerability stems from a race condition in the ARM64 KVM implementation of the Linux kernel. When a guest VM is active, the kernel walks the nested_mmus array under kvm->mmu_lock while the array may be reallocated under kvm->arch.config_lock. Because the reallocation frees the old buffer outside of mmu_lock, a concurrent walker may reference freed memory, yielding a use‑after‑free that can corrupt critical data structures. This flaw can lead to arbitrary code execution from kernel space or a forced kernel crash, impacting availability and potentially confidentiality and integrity at the host level.

The flaw is present in all Linux kernels running on ARM64 that enable KVM, regardless of distribution. Any system that loads the affected kernel and provides nested paging to guests is affected.

The CVSS score of 7.0 indicates medium‑to‑high severity. With no publicly known exploit and EPSS unavailable, the real‑world exploit probability is uncertain, but the attack surface is limited to guests that can trigger the race. If a malicious guest can execute code inside the KVM context, it may be able to trigger the reallocation timing to gain arbitrary code execution or crash the host. The flaw is not listed in CISA KEV, but due to its kernel‑level nature, system administrators should treat it as high risk.