Re: [PATCH v2 0/2] KVM: VMX: Fix IPIv use-after-free + improve checking duplicate vcpu_id

[Sean Christopherson]

On Wed, 29 Jul 2026 17:06:19 +0000, Dmytro Maluka wrote:
> vCPU creation in kvm_vm_ioctl_create_vcpu() may fail after
> kvm_arch_vcpu_create() -> vmx_vcpu_create() already succeeded. In such
> case kvm_vm_ioctl_create_vcpu() destroys the newly created vCPU in the
> failure path. However, that leaves a side effect: the IPIv pid_table
> entry remains configured with this vCPU's pi_desc address. As a result,
> when another vCPU sends an IPI to the APIC ID of this failed-to-create
> vCPU, it will cause HW to write to this (freed!) pi_desc memory.
> 
> [...]

Applied to kvm-x86 generic, thanks!

[1/2] KVM: Check for duplicate vcpu_id as early as possible
      https://github.com/kvm-x86/linux/commit/97d65b544f48
[2/2] KVM: VMX: Fix stale PID-pointer table entry left after vCPU free
      https://github.com/kvm-x86/linux/commit/b41f2ca6c060

--
https://github.com/kvm-x86/linux/tree/next