The vulnerability arises from the nested_mmus array that holds shadow page tables for nested guests in the Linux KVM hypervisor on arm64. When a virtual CPU is reinitialized while it is actively running a second‑level guest, a relocation of this array can occur. The running VCPU continues to reference the old, freed structure, creating a classic use‑after‑free condition. An attacker that can trigger such a scenario could corrupt kernel memory or execute arbitrary code with host privileges, as the flaw is a memory safety bug within the hypervisor component. This is a memory safety flaw identified by CWE-825.

Any Linux system that runs a kernel build for arm64 with the KVM nv module and has not incorporated the referenced commits is potentially affected. The advisory does not list exact kernel versions, so users should verify whether their kernel contains the fix or has been upgraded to a newer release. Distribution kernels that ship the KVM driver for arm64 without the patch are included in this risk pool.

The CVSS score of 7 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known. Based on the description, it is inferred that the likely attack vector requires local or privileged access to trigger a VCPU initialization during a nested guest session. Until a public exploit emerges, the overall risk remains moderate, but the kernel‑level impact warrants prompt attention.