Linux KVM x86/mmu: write tracking checked in one address space only, reaching a kernel BUG

Impact

kvm_gfn_is_write_tracked() consulted only the memslot it was handed, but write tracking is per-address-space while shadow pages are shared across address spaces. With SMM in play, a GFN tracked in one address space looks untracked through the other, which lets mmu_try_to_unsync_pages() mark an upper-level shadow page unsync and eventually hit the BUG in pte_list_remove(). That is a host-side kernel BUG reachable from guest activity, so the failure lands on the hypervisor, not just the VM: on a virtualized GPU host with passthrough or vGPU tenants, one guest can take down every tenant sharing the node. Exposure requires KVM on x86 with shadow paging in use and SMM active in the guest, which is not the common configuration for a Linux guest fleet - confirm your guest mix before treating this as urgent.

Who can reach it

A local guest on a KVM x86 host - no host credentials needed, only the ability to run code in a VM whose configuration exercises SMM and shadow paging.

What to do

Take the stable kernel fix (the linked git.kernel.org commits, backported across stable branches) via your distribution kernel. Applying it means drain the node and reboot into the patched kernel; live migration of tenants off the host first is the cheap version, and there is no configuration-only mitigation short of not exposing SMM-capable guests. No CVSS score or fixed distro version is present in this record.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical