CVE-2026-46147

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 architectures. During the vCPU initialization process, a pin leak can occur, leading to a permanent loss of references to host vCPU and SVE state pages. Additionally, a concurrent process might observe a partially initialized vCPU object due to improper publication ordering. These issues could lead to resource exhaustion and system instability, potentially resulting in a denial of service.