Linux kernel (arch/x86/kvm/svm): On AMD hosts that cannot report the next RIP, KVM's WRMSR/HLT/INVD fastpath has to

Impact

On AMD hosts that cannot report the next RIP, KVM's WRMSR/HLT/INVD fastpath has to decode the guest instruction, which reads guest memory - and it does so with interrupts disabled. A guest can therefore make the host kernel sleep in atomic context, which is a scheduling-while-atomic condition that can hang or crash the node; the impact is a shared-node DoS, not an escape.

Who can reach it

Guest-driven and unprivileged inside the VM: the tenant executes HLT, WRMSR or INVD from a page KVM must fault in to decode. Conditional on next-RIP being unavailable - older AMD silicon, or a host running with kvm_amd.nrips=0.

What to do

Update to a stable kernel with the linked fix (no fixed release enumerated; take the branch carrying commit da2a3c231f7f). Interim control: run on hosts with NRIPS support and never set kvm_amd.nrips=0.

References