Linux Kernel KVM x86 VM Hard Lockup Vulnerability After Prolonged Inactivity

A vulnerability in the Linux kernel's KVM module for x86 virtualization can lead to a hard lockup of the host system after a virtual machine (VM) has been inactive for a long period. This issue occurs when the VM is using the hypervisor timer (HV timer) in periodic mode on Intel CPUs. The problem arises because the HV timer only runs while the guest is active. If a VM is paused for an extended time, the timer can expire multiple times at once when the VM resumes, causing a backlog of interrupts. This backlog can be exacerbated if the VM was using the APIC timer in periodic mode, as seen when running a Windows VM that experienced a hard lockup after being suspended for a long time.

Impact

Exploitation of this vulnerability can cause a hard lockup on the host system, where the CPU becomes unresponsive and fails to execute tasks, effectively freezing the system.

Reproduction

To reproduce this vulnerability, suspend a KVM virtual machine running on an Intel CPU that uses the hypervisor timer in periodic mode. After a prolonged suspension, resume the VM. This will trigger a hard lockup on the host system, as the KVM hypervisor attempts to process the expired timers all at once, overwhelming the CPU and causing it to become unresponsive.

Remediation

Users can apply the available patches in the Linux kernel stable tree to address this vulnerability.