Linux kernel (arch/x86/kvm/mmu): A guest that creates a hugepage mapping extending below the bounds of a memslot makes

Impact

A guest that creates a hugepage mapping extending below the bounds of a memslot makes KVM link a shadow page whose GFN is outside the slot; hugepage recovery then indexes the slot's lpage_info array out of bounds. The observed result is a host page fault on a vmalloc address - a guest-driven out-of-bounds access in host kernel memory that takes the whole node with it.

Who can reach it

Driven from inside the guest by arranging its own page tables: the guest installs a hugepage mapping whose range crosses the edge of a memslot, then the host's hugepage recovery worker walks it. Requires the shadow MMU (guest without EPT/NPT-backed TDP, nested guests, or dirty-logging-forced 4K mappings). Any tenant VM on an affected node can set this up.

What to do

Update to a kernel with the referenced stable commits. Interim: avoid running tenants on the shadow-MMU path where possible - keep TDP enabled (kvm.tdp_mmu=Y / ept=1 / npt=1) and avoid long dirty-logging windows on unpatched nodes.

References