Linux kernel (arch/x86/kvm): A failed RSM leaves the vCPU's SMM flag and the MMU role out of sync, so KVM resolves a

Impact

A failed RSM leaves the vCPU's SMM flag and the MMU role out of sync, so KVM resolves a GFN against the non-SMM memslot set and then looks the rmap up in the SMM set. The mismatched lookup faults in host kernel context (KASAN reports a null-pointer dereference / general protection fault); more broadly it is memslot-set confusion inside the shadow MMU, driven by the guest.

Who can reach it

Guest-side: execute RSM in a way that fails emulation, then take a page fault. Found by syzkaller from an unprivileged process running a guest. Applies to guests with SMM enabled (the default for OVMF/secure-boot guest firmware) on the shadow MMU path.

What to do

Update to a kernel with the referenced stable commits (no fixed release string in the record - match by commit). Interim: disable SMM for tenant VMs on unpatched nodes where the guest firmware does not require it.

References