Linux kernel (arch/x86/kvm/vmx): With adaptive PEBS exposed, KVM never guaranteed that LBR MSRs held guest values

Impact

With adaptive PEBS exposed, KVM never guaranteed that LBR MSRs held guest values before VM entry, so a guest can request LBR entries in its PEBS records and read back host RIPs - host kernel addresses and host execution paths - straight into the VM. Adaptive records also carry memory-access info that can sidestep the host's PMU event filter, and KVM generated adaptive records even when the guest asked for basic ones.

Who can reach it

Guest-driven and unprivileged inside the VM: the tenant programs PEBS and LBR MSRs from its own vCPU. Requires an Intel host with vPMU enabled and PEBS enumerated in the guest's CPUID - the case whenever performance counters are handed to tenants.

What to do

Update to a stable kernel with the fix (adaptive PEBS support is dropped; no fixed release is enumerated, take the branch with commit 7a7650b3ac23). Interim control: do not expose the vPMU to tenant guests - run with kvm.enable_pmu=0 or strip PEBS/LBR from guest CPUID.

References