Linux kernel (arch/x86/kvm/vmx): Between the point where KVM loads the guest's SPEC_CTRL value and the actual VM entry

Impact

Between the point where KVM loads the guest's SPEC_CTRL value and the actual VM entry there were returns that could be resolved from a depleted or guest-influenced RSB, giving speculative execution in host context while host branch protections are already relaxed. The payoff for a tenant is the same as the vmexit case: speculative reads of host kernel memory recovered over a side channel.

Who can reach it

Guest-driven on Intel hosts: the tenant primes predictor state and relies on host NMI activity to drain the RSB in the entry window. High complexity and probabilistic, but requires nothing more than an ordinary vCPU - no host privilege, no passthrough device, no VMM cooperation.

What to do

Patch and reboot into a kernel carrying this fix alongside the vmexit RSB fill (CVE-2022-49611); the two are halves of one mitigation and should be deployed together. No interim runtime control.

References