Linux Kernel EUVD-2026-35406

Requires (1) an arm64 host CPU with ARMv8.4 Nested Virtualization (NV) extensions, (2) a Linux kernel built with KVM and nested virt support, (3) nested virtualization actively enabled by the host operator (it is not on by default in mainline KVM/arm64), (4) local access to /dev/kvm such that the attacker can invoke KVM_ARM_VCPU_INIT with the nested feature flag, and (5) the ability to trigger MMU notifier paths concurrently (e.g., memory pressure, madvise, or guest memory unmapping). Limiting factors: x86 and arm64-without-NV hosts are not vulnerable, the bug is a narrow TOCTOU race so reliable exploitation requires precise timing, and unprivileged users without KVM ioctl access cannot reach the vulnerable code path.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.8) reflects local exploitation by a low-privileged actor with scope change - consistent with a guest-to-host escape in nested virtualization. However, AC:L is questionable for a narrow TOCTOU window between two locks; in practice this is a race that requires precise timing, so AC:H is more defensible. EPSS at 0.02% (4th percentile) and absence from CISA KEV indicate no observed exploitation, which aligns with the unusually narrow precondition: the host must run an arm64 CPU with ARMv8.4-NV and have nested virtualization enabled for KVM guests - not a default in most deployments. Net real-world priority is moderate for cloud/hyperscaler operators running nested KVM on Ampere/Neoverse-class hardware, and low for general server fleets. No conflicting signals; data is internally consistent.

A local attacker with permission to create KVM guests on an arm64 host (e.g., a tenant on a multi-tenant virtualization platform, or a low-privilege user in the kvm group) starts a VM with nested virtualization enabled and races repeated kvm_vcpu_init_nested() calls against memory-pressure-induced MMU notifier invalidations on the host. Winning the race dereferences the freed nested_mmus buffer from the mmu_lock path, yielding kernel use-after-free that can be steered toward arbitrary read/write of host kernel memory. No public exploit identified at time of analysis.