Linux kernel (arch/x86/kvm): An emulated MMIO write that straddles a page boundary onto a second MMIO page is split

Impact

An emulated MMIO write that straddles a page boundary onto a second MMIO page is split into two userspace exits, with the second exit still pointing at an on-stack variable from the first. If the second KVM_RUN comes from a different task, the host kernel reads a freed kernel stack - KASAN caught exactly that. Freed host kernel stack contents flow into data the VM side can observe.

Who can reach it

Started by the guest: it issues a store that splits a page and lands on emulated MMIO on both halves. The freed-stack condition needs the completing KVM_RUN to be issued from a different task, which the VMM process controls - so full weaponisation wants /dev/kvm access (nested-virt tenant or local user), while the guest alone controls the trigger.

What to do

Update to a kernel with the referenced stable commits. Interim: keep /dev/kvm out of tenant containers and disable nested virtualization for tenants on unpatched nodes.

References