Linux kernel (arch/x86/kvm): A guest using its APIC timer in periodic mode can leave KVM programming an already-expired

Impact

A guest using its APIC timer in periodic mode can leave KVM programming an already-expired hypervisor timer over and over, producing a practically unbounded storm of host hrtimer interrupts. The upstream fix states this can hard-lock the host - a whole-node outage that takes every other tenant on the box down with it, so the impact is DoS rather than escape.

Who can reach it

The guest side is trivial and unprivileged: any tenant programs a periodic LAPIC timer. The trigger is a long gap in vCPU execution - VM pause/suspend, a live-migration blackout window, or severe host oversubscription - after which the expiration delta goes negative and overflows what the VMX preemption timer can encode. Intel hosts using the hypervisor timer, which is the default.

What to do

Update to a stable kernel carrying the linked fix; the record's version list does not name a usable fixed release, so track the branch containing commit 786ed625c125. Interim controls: avoid long pause/suspend of running tenant VMs and, at a performance cost, disable the VMX preemption timer for KVM (kvm_intel.preemption_timer=0) so the software hrtimer path is used.

References