Re: [PATCH v2 0/2] KVM: nVMX: Fix ept=n bugs where KVM runs L2 with guest CR3

[Sean Christopherson]

On Fri, 12 Jun 2026 07:56:40 -0700, Sean Christopherson wrote:
> Fix two bugs where KVM can run L2 with a guest-controlled CR3.  The underlying
> flaw dates back to commit f087a02941fe ("KVM: nVMX: Stash L1's CR3 in
> vmcs01.GUEST_CR3 on nested entry w/o EPT").  Past me claimed:
> 
>   Smashing vmcs01.GUEST_CR3 is safe because nested VM-Exits, and the unwind,
>   reset KVM's MMU, i.e. vmcs01.GUEST_CR3 is guaranteed to be overwritten with
>   a shadow CR3 prior to re-entering L1.
> 
> [...]

Applied to kvm-x86 fixes, thanks!

[1/2] KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks
      https://github.com/kvm-x86/linux/commit/ebdac7554abb
[2/2] KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabled
      https://github.com/kvm-x86/linux/commit/3e6dd2b9b7b2

--
https://github.com/kvm-x86/linux/tree/next