CVE-2026-53277

A flaw was found in the Kernel-based Virtual Machine (KVM) component of the Linux kernel on arm64 architectures. This vulnerability occurs because certain page table walk operations, used in fault injection and Address Translation (AT) emulation, do not properly acquire a Sleepable Read-Copy Update (SRCU) lock. This omission could lead to inconsistencies in memory slot management, potentially causing system instability or unexpected behavior within the virtualized environment.

A flaw of important severity was found in the Kernel-based Virtual Machine (KVM) arm64 support of the Linux kernel. The page table walk helpers walk_s1() and kvm_walk_nested_s2(), which are used during fault injection and Address Translation (AT) emulation, expect to be called while holding the kvm->srcu lock that guards against memory slot (memslot) changes. However, __kvm_at_s12() and __kvm_find_s1_desc_level() call into these walkers without taking kvm->srcu, so those operations can race with memslot changes and lead to inconsistencies in memory slot management, potentially causing system instability or unexpected behavior within the virtualized environment. Exploitation requires local access with low privileges and successfully winning a race condition, as reflected in the Red Hat CVSS:3.1 score of 7.0 IMPORTANT (AV:L/AC:H/PR:L/UI:N/S:U), which matches the upstream CVEORG severity. This flaw affects the kernel and kpatch components in Red Hat Enterprise Linux 10 and the kernel components in Red Hat In-Vehicle OS 2, where a fix is being pursued through the delegated maintenance streams. The kernel, kernel-rt, and kpatch components in Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.