A use-after-free in Linux KVM/x86 shadow MMU stale-root check ordering lets an attacker with L1 guest kernel privileges escape when nested virtualization is exposed to untrusted guests. Affects Linux 5.9+ until fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5.