Linux kernel (arch/x86/kvm): A guest that disables paravirtual EOI while KVM still has a pending PV-EOI request, and

Impact

A guest that disables paravirtual EOI while KVM still has a pending PV-EOI request, and arranges for the read of the PV-EOI area to fail, hits a kernel BUG in the LAPIC sync path. Denial of service rather than escape, but it is one tenant reliably crashing host kernel context - a node-level outage risk for everyone sharing the machine.

Who can reach it

Entirely guest-driven and reproduced by a small in-guest test program: unmap or invalidate the PV-EOI page so the host's read fails, then disable PV EOI via the KVM paravirt MSR. Applies to any guest using KVM paravirt EOI, which is the default for Linux guests on KVM.

What to do

Update to a kernel with the referenced stable commits. Interim: disable the KVM PV EOI feature bit in the guest CPU model on unpatched nodes, and keep panic_on_oops off there so the crash stays inside the offending VM's kernel context.

References