Linux Kernel CVE-2026-46147

The vulnerability resides in the arm64 pKVM (protected KVM) hypervisor subsystem within the Linux kernel, specifically in the __pkvm_init_vcpu() function responsible for initializing guest vCPU objects in the protected hypervisor memory region. The root cause class is CWE-401 (Missing Release of Memory after Effective Lifetime), manifesting as leaked pin references obtained via hyp_pin_shared_mem() for both the host vCPU structure and SVE (Scalable Vector Extension) register-state pages. Pin references in this context are counted references that prevent host pages from being reclaimed or remapped while the hypervisor operates on them; leaking them permanently prevents release of those pages. Bug 2 is a memory ordering flaw: a bare C store is used to publish the hyp_vcpu pointer into hyp_vm->vcpus[], which on weakly ordered architectures (arm64 uses a relaxed memory model) does not guarantee that all prior writes to the hyp_vcpu object are visible before the pointer itself becomes visible to concurrent readers. The fix uses smp_store_release() on the write side and smp_load_acquire() on the read side to establish the required happens-before relationship. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covering all versions from the initial kernel commit through the fix points.