Linux kernel (arch/x86/kvm/mmu): The TDP MMU skipped invalid roots when unmapping a GFN range, so KVM could still hold

Impact

The TDP MMU skipped invalid roots when unmapping a GFN range, so KVM could still hold references to host pages after an MMU-notifier callback had returned - the exact guarantee that keeps a guest from touching host memory the kernel has already reclaimed. Completing the zap afterwards means KVM writes to and dirties pages that no longer belong to the VM.

Who can reach it

No special guest action needed: the window opens whenever a root is invalidated (memslot updates, VM teardown, nx_huge_pages toggling) while the host reclaims guest memory through the MMU notifier - swap, KSM, THP collapse, ballooning. On a memory-oversubscribed GPU node with several tenants, that is routine operation rather than an exotic race.

What to do

Update to a kernel with the referenced stable commits (no fixed release string in the record - match by commit). Interim: avoid memory overcommit / aggressive reclaim on unpatched hypervisor nodes and do not toggle kvm.nx_huge_pages at runtime on a node with live guests.

References