Linux kernel x86/kvm: NMI-context page fault consumes async #PF flags and panics the guest

Impact

Inside a KVM guest, the reason for an async page fault sits in per-CPU apf_reason.flags until the #PF handler reads and clears it. If an NMI lands in that window and the NMI handler itself takes a page fault, the nested fault consumes the flags belonging to the fault it interrupted, then sees interrupts disabled and panics with "Host injected async #PF in interrupt disabled region". The reporter reproduced it reliably - 3 of 3 runs panicked - with perf sampling user call chains in a guest whose memory is served on demand through userfaultfd, and the same window exists for an L1 hypervisor using DELIVERY_AS_PF_VMEXIT. For an operator this is a guest-availability bug: a GPU VM that is live-migrated, restored from a snapshot, or backed by demand-paged memory while anything profiles with user call chains can crash outright, taking the passed-through accelerators down with it. No privilege escalation or information disclosure is described.

Who can reach it

Local, inside the guest. Any workload that triggers kernel page faults from NMI context - perf with user call chains is the worked example - on a guest that takes async page faults. No authentication beyond the ability to run code or profile in the VM; the host is not the attacker.

What to do

Pick up the stable kernel commits on your guest kernels and reboot each guest; the fix is a guest-side change, so hosts need no action. On a GPU VM this means draining the workload and restarting the instance, which for passthrough or vGPU guests is a full instance restart rather than a live operation. No vendor advisory with fixed release numbers is in the record beyond the stable commits.

References

Related entries

• Linux kernel trusted_keys: a failed TPM unseal can still instantiate the key when pcrlock succeedsCVE-2026-99221 · Linux kernel keys/trusted_keys (TPM unseal error swallowed by pcrlock)Unscored
• Linux kernel keys: read method checked outside key->sem, so KEYCTL_READ can touch a freed key type moduleCVE-2026-99222 · Linux kernel keys (keyctl_read_key type method check outside key->sem)Unscored
• Linux kernel keys: keyring ordering leaks kernel addresses, defeating KASLR for a local userCVE-2026-99223 · Linux kernel keys (keyring associative-array index derived from kernel addresses)Unscored
• Linux kernel keys: NULL authorization payload dereferenced during a process keyring search, oopsing the hostCVE-2026-99225 · Linux kernel keys (request-key authorization payload in search_process_keyrings_rcu)Unscored
• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical