Linux kernel (arch/x86/kvm/vmx): The return stack buffer was not refilled on VM exit when the host used IBRS/eIBRS as

Impact

The return stack buffer was not refilled on VM exit when the host used IBRS/eIBRS as its Spectre-v2 mitigation, so return predictions a guest planted survive into host kernel execution immediately after the exit. A tenant VM can speculatively steer host returns and read host kernel memory through a cache side channel - a cross-boundary information leak, no crash and no trace in dmesg.

Who can reach it

Guest-driven and unprivileged inside the VM: any tenant vCPU can shape the RSB and then force a VM exit. Applies to Intel hosts running the IBRS/eIBRS mitigation path with kvm_intel loaded; nothing has to be exposed to the guest beyond a normal vCPU.

What to do

Update to a stable kernel carrying this fix together with the companion RSB fixes (the record lists 4.14.297 among the affected lines). No runtime knob substitutes for the fix; switching the host to retpoline-based mitigation changes but does not remove the exposure, so patch and reboot.

References