Linux kernel (arch/x86/kvm/mmu): When guest memory is backed by a VM_PFNMAP mapping, KVM derived the target page frame

Impact

When guest memory is backed by a VM_PFNMAP mapping, KVM derived the target page frame from vm_pgoff, which is a file offset and has nothing to do with the mapped pfn. Updating guest page-table accessed/dirty bits therefore wrote into effectively arbitrary host physical pages - a tenant's ordinary page-table walks corrupt host memory outside its own VM.

Who can reach it

Guest-driven with no special guest privilege: every vCPU memory access can cause KVM to set A/D bits during a shadow page-table walk. Reachable whenever any part of the guest's address space is backed by a VM_PFNMAP VMA - device memory, /dev/mem backing, or a passthrough BAR mapped into the guest, which is the normal shape of a GPU-passthrough VM.

What to do

Update to a stable kernel containing the linked fix (no fixed release is enumerated in the record; take the branch carrying commit f122dfe44768). Interim control: back tenant VMs with ordinary anonymous/hugetlb memory only and avoid VM_PFNMAP-backed memslots, including /dev/mem-backed regions, on unpatched hosts.

References