CVE-2026-98440

What it actually does

Use-after-free in KVM arm64 nested virtualization due to premature freeing of shadow stage-2 page table containers from kvm_arch_flush_shadow_all() while references may still exist.

Why it matters to the business

On hosts running nested virtualization workloads, this flaw could lead to guest-triggered kernel crashes or limited memory corruption; low public exploit activity and no known ransomware use reduce immediate operational risk.

How an attack unfolds

An attacker with control of a nested guest triggers shadow S2 structure allocation and subsequent flush operations that free the container early; later accesses from remaining vCPU or MMU paths dereference the freed memory, enabling potential corruption or information disclosure before VM teardown.

How to fix it

Update to a Linux kernel version containing the fix that moves shadow S2 destructor logic to VM destruction time; apply the patch that separates MMU and global array teardown from flush callbacks.

How to confirm the fix worked

Confirm the presence of separate destructors called only at final VM teardown and verify that kvm_arch_flush_shadow_all() no longer releases shadow S2 containers; review kernel changelog for the specific commit and test nested VM creation/destruction cycles for stability.

Typical attack path

1. Obtain nested virtualization access inside a guest VM
2. Force repeated allocation and flush of shadow S2 structures
3. Trigger kvm_arch_flush_shadow_all() to release containers while references remain
4. Perform subsequent MMU or vCPU operations that access the freed structures
5. Leverage resulting use-after-free for memory corruption or crash

How to detect it

Search kernel logs and audit trails for unexpected KVM MMU or shadow page table errors around VM creation and destruction events; look for crashes or warnings referencing S2 structures or flush_shadow paths on arm64 systems.

What your security team should do

• Prioritize kernel updates on any arm64 hosts enabling nested KVM virtualization
• Monitor EPSS and KEV status for changes given the five-day publication window
• Restrict nested virtualization to trusted workloads until patches are deployed
• Audit systems for arm64 KVM usage and schedule staged rollouts