Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way that

Impact

After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way that lets two vCPUs belonging to DIFFERENT VMs run on the same physical CPU with the same ASID. They then share nested-page-table TLB entries, so one tenant's guest resolves addresses through another tenant's translations. This is direct cross-tenant memory read and write exposure, with no attacker skill required once the condition exists.

Who can reach it

No tenant action needed to create the hazard - it is created by the operator's own CPU hotplug (maintenance, core parking, power management) on AMD nodes running kvm_amd. Any two co-resident guests pinned to the recycled pCPU can end up sharing an ASID; a tenant that can influence its own vCPU placement and probe memory will notice foreign data. AMD SVM only.

What to do

Update to a kernel with the referenced stable commits. Interim, and this one is actionable today: stop doing CPU offline/online cycles on AMD hypervisor nodes carrying live guests - drain the node before any hotplug operation, and reboot rather than hot-cycling CPUs.

References