Use-after-free in Linux kernel KVM arm64 nested_mmus reallocation

CVE-2026-46317 is a Linux kernel KVM/arm64 vulnerability in the handling of kvm->arch.nested_mmus[]. The array is walked while holding kvm->mmu_lock, including from the MMU notifier path via kvm_unmap_gfn_range() -> kvm_nested_s2_unmap(), which may execute asynchronously. However, kvm_vcpu_init_nested() could reallocate the nested_mmus array and free the old buffer while holding only kvm->arch.config_lock. This creates a race where concurrent walkers can dereference the freed array, resulting in a use-after-free. The fix allocates a replacement array outside mmu_lock, then under mmu_lock copies existing entries, repairs back pointers, and atomically reassigns the array, with the old buffer freed only after dropping the lock.