Linux kernel (arch/x86/kvm/svm): KVM read Page State Change entries and indices out of a guest-writable buffer more

Impact

KVM read Page State Change entries and indices out of a guest-writable buffer more than once, so a guest that rewrites the buffer between the bounds check and the use defeats the validation and steers the host past the buffer. This is what makes the neighbouring PSC bounds fixes bypassable, turning them back into a guest-to-host memory-safety break.

Who can reach it

A SEV-SNP guest races a second vCPU against the vCPU that submitted the PSC request, mutating the shared GHCB buffer while the host processes it. Entirely guest-side; requires only that the node runs SEV-SNP guests under kvm_amd.

What to do

Update to a kernel carrying the referenced stable commits (no fixed release string published). This fix travels with the other GHCB scratch-area fixes in the same series - take the whole set, not just one. Interim: move SEV-SNP tenants off unpatched hosts.

References