Linux kernel (arch/x86/kvm/svm): If AVIC is inhibited while a nested guest is running, KVM leaves the x2APIC MSRs

Impact

If AVIC is inhibited while a nested guest is running, KVM leaves the x2APIC MSRs unintercepted for the outer guest. That guest can then read most of the host's real APIC state, send arbitrary interrupts to host CPUs (including the posted-interrupt wakeup vector), change host task priority, and trivially take the node down. This is a guest reaching directly into host interrupt state.

Who can reach it

Driven from inside a guest on an AMD host: the guest starts a nested VM while AVIC is fully enabled, then triggers a VM-scoped AVIC inhibit, and afterwards issues raw x2APIC MSR reads/writes from L1. Requires AMD hardware with AVIC enabled and nested virtualization exposed to the tenant. Not reachable from a plain container tenant.

What to do

Update to a kernel with the referenced stable commits. Interim: disable AVIC on affected AMD nodes (kvm_amd avic=0) and/or stop exposing nested virtualization to tenants (kvm_amd nested=0) until patched.

References