Linux kernel (arch/x86/kvm/vmx): Nested teardown freed the shadow VMCS page while vmcs01 still referenced it, and

Impact

Nested teardown freed the shadow VMCS page while vmcs01 still referenced it, and because the clear is asynchronous a vCPU that migrates afterwards makes the CPU execute VMCLEAR against a page already returned to the allocator. That is hardware writing into reallocated host kernel memory - a use-after-free in the host driven by ordinary nested-VMX activity in a guest.

Who can reach it

Guest-driven: a tenant uses VMX inside its VM and then tears the nested state down (VMCLEAR/VMXOFF, or nested state teardown), and the freed page is written when the vCPU is next scheduled on a different physical CPU. Requires nested VMX exposed to the guest (Intel host, kvm_intel nested=1, VMX in guest CPUID). No host privilege needed.

What to do

Update to a stable kernel with the linked fix (no fixed release enumerated; take the branch carrying commit dc3eecfa219e). Interim control: disable nested virtualization for tenant guests (kvm_intel.nested=0) - that removes the whole path.

References