Linux kernel (virt/kvm): A guest store that splits a page and lands on a datamatch-enabled ioeventfd reaches a BUG_ON

Impact

A guest store that splits a page and lands on a datamatch-enabled ioeventfd reaches a BUG_ON in KVM's ioeventfd handling because of an alignment assumption that does not hold. Impact is denial of service, not escape - but it is a guest hitting a kernel BUG on the host, so on a node with panic_on_oops set it is a whole-node outage for every co-resident tenant.

Who can reach it

Pure guest-side: emit an unaligned store (e.g. a 16-byte store at page offset 0xffc) where the second page carries a datamatch ioeventfd at offset 0 - a virtio doorbell is exactly such an ioeventfd, so every VM with virtio devices has the target. No host privilege needed.

What to do

Update to a kernel with the referenced stable commits. No meaningful interim control - ioeventfds are how virtio doorbells work. Set panic_on_oops deliberately: leaving it off keeps the blast radius to the one VM rather than the node.

References