Linux KVM (arch/x86/kvm/svm.c, vmx.c) and Xen 4.3.x-4.6.x - #AC exception handling: A guest raises alignment-check

Impact

A guest raises alignment-check exceptions in a tight loop and the host panics or hangs. No exploit chain, no memory corruption, no privilege needed inside the guest beyond running instructions - a few lines of assembly from an unprivileged process in any tenant VM takes down the whole physical machine and every co-tenant's workload with it. For a GPU cloud where one node carries eight accelerators and potentially several tenants, this is the cheapest possible cross-tenant availability attack and it hits KVM and Xen alike.

Who can reach it

Guest OS user - not even guest administrator - in any VM on the host. Unprivileged code inside the tenant's own guest is sufficient.

What to do

Kernel update for KVM hosts, XSA-156 patches for Xen; both need a host reboot with tenants evacuated. There is no configuration workaround - you cannot disable #AC delivery - so unpatched hosts simply have this exposure. Given how trivially triggerable it is, treat it as a gating check before a host is allowed to accept multi-tenant placement, rather than something to schedule into a routine patch cycle.

References