KVM x86 Hyper-V stimer: overflowed deadline livelocks the vCPU thread and stalls RCU on the host

Impact

A guest (or the VMM) can program a Hyper-V synthetic timer with a COUNT near U64_MAX so the deadline calculation overflows into the past. The hrtimer then fires immediately, KVM re-arms it, the pending request aborts every guest entry, and vcpu_run() spins without yielding. The loop starves RCU grace-period kthreads - syzkaller reproduced multi-second rcu_preempt stalls - and on a SCHED_FIFO vCPU thread it can wedge the CPU outright. On a GPU host running Windows or Hyper-V-enlightened guests that is one tenant pinning a core and degrading or hanging the whole node, which then has to be rebooted; nothing is disclosed or modified, the damage is availability.

Who can reach it

Local to the host via a guest: any tenant VM on an x86 KVM host where Hyper-V synthetic timer emulation is enabled can write the MSRs itself. No host credentials required.

What to do

Apply the stable-kernel fix that clamps the stimer deadline (commits below) and reboot the affected hypervisor hosts after draining their VMs. As an interim measure, do not expose the Hyper-V SynIC/stimer enlightenments to untrusted guests, and avoid running vCPU threads at SCHED_FIFO, which is what turns the livelock into a full CPU stall.

References

Related entries

• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh
• Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationCVE-2021-22600 · Linux kernel (af_packet)High
• Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationCVE-2021-4204 · Linux kernel (eBPF)High
• Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runCVE-2022-0492 · Linux kernel (cgroups v1)High
• Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootCVE-2022-2602 · Linux kernel (io_uring)High
• Linux kernel (OverlayFS/FUSE): OverlayFS copies setuid files from a nosuid FUSE mountCVE-2023-0386 · Linux kernel (OverlayFS/FUSE)High