Linux kernel (arch/x86/kvm): A guest that is not advertised long mode makes the host's SMM emulator walk 16

Impact

A guest that is not advertised long mode makes the host's SMM emulator walk 16 general-purpose register slots through a 32-bit SMRAM image, running off the end of the host-side buffer. The overrun happens in host kernel memory while emulating SMI entry and RSM, so a tenant VM gets an out-of-bounds host kernel read/write instead of a contained guest fault.

Who can reach it

Fully guest-driven on a 64-bit host: a tenant running a VM whose CPUID lacks X86_FEATURE_LM raises an SMI (a guest can direct one at itself through the emulated local APIC) and executes RSM. No VMM cooperation, no ioctl, no device node inside the container or guest is required.

What to do

Boot a kernel carrying the linked stable fix; the record enumerates no fixed release, so pick the stable point release that contains commit a7ebfbea0f52. Interim control: always expose long mode (X86_FEATURE_LM) in tenant guest CPUID so the 32-bit SMRAM path is never taken, since SMM emulation itself cannot be turned off per VM.

References