Linux kernel (arch/x86/kvm/vmx): When a nested VM-Enter fails on invalid guest state, KVM took an open-coded exit path

Impact

When a nested VM-Enter fails on invalid guest state, KVM took an open-coded exit path that never released the vmcs12 pages it had already pinned and mapped. An L1 guest that retries VMLAUNCH in a loop leaks pinned, unswappable host pages on every attempt, letting one tenant grind the node's memory down until the host OOMs - a noisy-neighbour outage for everything else on the box.

Who can reach it

Guest-driven and unprivileged inside the VM: the tenant loops VMLAUNCH/VMRESUME with deliberately invalid guest state in its vmcs12. Requires nested VMX to be exposed - Intel host with kvm_intel nested=1 (the default) and VMX in the guest's CPUID.

What to do

Update to a stable kernel with the linked fix (no fixed release enumerated; take the branch carrying commit 2f2312c422fd). Interim controls: do not expose nested virtualization to tenants (kvm_intel.nested=0), and cap per-VM host memory with cgroup limits so a leaking guest cannot consume the whole node.

References