Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated against

Impact

VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated against vmcb02 instead of vmcb01, so the nested guest reads and overwrites the wrong control block - segment bases, TR/LDTR, and the SYSCALL/SYSENTER MSR state belonging to the other level. A workload inside a nested guest can harvest or corrupt its hypervisor's saved state in host-managed pages.

Who can reach it

Guest-driven: requires nested SVM exposed to the tenant (AMD host, kvm_amd nested=1) and an L2 running with virtual VMLOAD/VMSAVE not intercepted by L1. The instruction is executed directly by guest code - no ioctl, no host privilege.

What to do

Update to a stable kernel with the linked fix (no fixed release enumerated; take the branch carrying commit 3880e331b0b3). Interim control: withhold nested virtualization from tenant guests (kvm_amd.nested=0) or disable virtual VMLOAD/VMSAVE so the instructions always trap.

References