Linux kernel (virt/kvm): Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if the

Impact

Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if the memslot is freed first the release path writes eight bytes through a freed pointer. syzbot and KASAN confirm the slab use-after-free write in host kernel memory - a straightforward kernel corruption primitive on nodes that run confidential VMs.

Who can reach it

Reached through KVM ioctls on the VM fd (memslot deletion racing guest_memfd close), not from inside a guest. Under a trusted-VMM model this is not a tenant path; it becomes one wherever untrusted local users or tenant-controlled VMM processes hold /dev/kvm, where it is a local privilege-escalation primitive. Only nodes with guest_memfd in use (SEV-SNP / TDX confidential VMs) exercise this code.

What to do

Update to a stable kernel carrying the linked fix (no fixed release enumerated; take the branch containing commit ae431059e75d). Interim control: keep /dev/kvm out of tenant containers and restricted to the operator's VMM account.

References