CVE-2026-98440 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great.
Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuke both the individual MMUs as well as the global array that points to them, safe in the knowledge that the vcpus themselves have been destroyed already.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's KVM subsystem for ARM64 architectures contained a critical memory management flaw related to nested virtualization and shadow stage-2 page table structures. The vulnerability originated from an improper lifecycle management of these data structures, specifically within the kvm_arch_flush_shadow_all function. This callback is designed to handle the flushing of cached translations and freeing of individual page table pages when address space layouts change or VMs are paused. However, the implementation incorrectly extended this scope to include the destruction of the container objects that hold references to shadow stage-2 structures. These containers represent significant kernel memory allocations that manage complex state for nested virtualization scenarios where a guest acts as a hypervisor itself.
The core technical flaw lies in the premature deallocation of these container structures while they may still be actively referenced by other parts of the system, such as running vCPU threads or pending asynchronous operations. By freeing the container too early during the shadow flush process rather than waiting for full VM teardown, the kernel introduced a use-after-free condition. This race condition allows an attacker with access to nested virtualization capabilities to trigger memory corruption. When the container is freed but still referenced, subsequent accesses result in undefined behavior, potentially leading to kernel panics, data leakage, or arbitrary code execution within the host kernel context. The issue highlights a fundamental misunderstanding of reference counting and object lifetime management in concurrent multi-threaded environments typical of virtualization stacks.
From an operational impact perspective, this vulnerability affects systems utilizing ARM64 processors with KVM enabled for nested virtualization workloads. Attackers who can create or manipulate guest VMs that themselves run hypervisors could exploit the race condition to destabilize the host system. The severity is heightened by the fact that it involves kernel memory corruption, which bypasses user-space isolation boundaries entirely. Successful exploitation could lead to a complete compromise of the physical server hosting the virtual machines, affecting all co-located tenants and services. This represents a significant risk in cloud computing environments where nested virtualization is increasingly common for container orchestration and specialized workload execution.
The resolution involves restructuring the cleanup logic to strictly separate page table deallocation from object destruction. The fix introduces dedicated destructors that are invoked only during the final VM teardown phase, specifically after all vCPU threads have been terminated and no further references can exist. This ensures that both individual MMU contexts and global arrays pointing to them are safely nuked when it is guaranteed that no other subsystem holds active pointers to these structures. By aligning the lifecycle of shadow S2 containers with the actual existence of their associated virtual CPUs, the kernel eliminates the window for use-after-free exploitation.
This vulnerability maps directly to CWE-416, Use After Free, as the primary failure mode involves accessing memory after it has been freed due to incorrect timing in resource deallocation. In terms of attack vectors and techniques, this aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, if leveraged for initial access via nested VM creation, but more critically relates to privilege escalation mechanisms that exploit kernel memory corruption such as those described under T1068, Exploitation for Privilege Escalation. The fix reinforces the importance of adhering to strict object lifetime rules in virtualization layers, ensuring that cleanup routines do not interfere with active execution contexts or shared state structures. System administrators should ensure their Linux kernels are updated to include this patch to mitigate risks associated with nested virtualization on ARM64 platforms.