Linux kernel (arch/x86/kvm): When KVM failed to program the interrupt remapping table for irq bypass, it left a

Impact

When KVM failed to program the interrupt remapping table for irq bypass, it left a dangling pointer to the interrupt producer. For VFIO PCI the producer lives inside the per-vector context and is freed when the vector is disabled, so KVM later dereferences freed memory - a host kernel use-after-free in the interrupt path of a passthrough device.

Who can reach it

Requires device passthrough with interrupt bypass - exactly the configuration used for GPU and NIC passthrough in a GPU cloud. A tenant (or the VMM acting on tenant-controlled MSI-X configuration) disables an MSI-X vector on the assigned device while KVM's routing still references the producer; an IRTE update failure leaves the stale pointer behind. Needs /dev/vfio access plus an assigned device, i.e. any tenant VM with a passed-through GPU or NIC.

What to do

Update to a kernel with the referenced stable commits. Interim: there is no clean workaround short of dropping IRQ bypass (disable posted interrupts / kvm halt_poll and IRQ bypass on the node) or not passing devices through, both of which cost GPU-VM performance - patch and reboot is the real fix.

References