Linux kernel (arch/x86/kvm/vmx): The nested vTPR versus TPR-threshold consistency check ran only after KVM had already

Impact

The nested vTPR versus TPR-threshold consistency check ran only after KVM had already loaded state, and the failure path did not unwind vmcs01.GUEST_CR3 back to KVM's own value. With EPT disabled, L1 then runs with a CR3 the guest chose rather than the shadow page-table root KVM installed - the guest picks the page tables the CPU walks, which is the shortest path there is to reading and writing host memory from inside a VM.

Who can reach it

Guest-driven: the tenant executes VMLAUNCH/VMRESUME with a vmcs12 whose tpr_threshold fails the check. Needs three things to line up - nested VMX exposed to the guest, shadow paging in use (EPT off or unavailable), and the off-by-default early consistency check enabled (kvm_intel.nested_early_check=1) - which is why the CNA rates complexity high.

What to do

Update to a stable kernel with the linked fix (no fixed release enumerated; take the branch carrying commit ebdac7554abb). Interim controls: keep EPT enabled (kvm_intel.ept=1), leave kvm_intel.nested_early_check off, and do not expose nested virtualization to tenants.

References