Linux kernel (arch/x86/kvm): The guard against accessing bytes 4-15 of an emulated APIC register was dropped, and

Impact

The guard against accessing bytes 4-15 of an emulated APIC register was dropped, and reading those offsets leaks host kernel stack contents straight back to the guest. A tenant VM gets a repeatable read primitive into host kernel memory - useful for defeating KASLR and for harvesting whatever else sits on that stack.

Who can reach it

Issued from inside the guest with no privileges beyond guest ring 0: read an emulated local-APIC register at a misaligned offset. Applies to guests running with the in-kernel LAPIC and without APIC virtualization handling the access.

What to do

Update to a kernel with the referenced stable commits (no fixed release string published - match by commit). There is no practical interim control short of patching; the LAPIC is not something you can take away from a guest.

References