Linux kernel (arch/x86/kvm/svm): When a GSI route changed to something that cannot be posted, KVM only fixed up the

Impact

When a GSI route changed to something that cannot be posted, KVM only fixed up the interrupt remapping table entry if the new route was an MSI, leaving IRTEs still posting interrupts directly to a vCPU. An assigned device's interrupts then get delivered into a guest that should no longer receive them, and if the VM is torn down while the entry still points at it the hardware writes posted-interrupt state into freed host memory - a device-driven use-after-free that outlives the VM.

Who can reach it

Requires device assignment - VFIO passthrough, which is the normal shape of a GPU tenant node - plus AMD AVIC or Intel posted interrupts. The stale entry is created by an interrupt-routing update on a running VM and is then exercised by the physical device itself, so the fallout lands on the host and on whoever gets that device next, not only on the VM that created it.

What to do

Update to a stable kernel carrying the linked fix (no fixed release enumerated; take the branch with commit 023816bd5fa4). Interim controls: avoid IRQ-routing changes on running passthrough VMs, scrub and re-probe assigned devices between tenants, or disable interrupt posting (kvm_amd.avic=0 / kvm_intel.enable_apicv=0) at a performance cost.

References