CVE-2025-71104

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer

When advancing the target expiration for the guest's APIC timer in periodic

mode, set the expiration to "now" if the target expiration is in the past

(similar to what is done in update_target_expiration()). Blindly adding

the period to the previous target expiration can result in KVM generating

a practically unbounded number of hrtimer IRQs due to programming an

expired timer over and over. In extreme scenarios, e.g. if userspace

pauses/suspends a VM for an extended duration, this can even cause hard

lockups in the host.

Currently, the bug only affects Intel CPUs when using the hypervisor timer

(HV timer), a.k.a. the VMX preemption timer. Unlike the software timer,

a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the

HV timer only runs while the guest is active. As a result, if the vCPU

does not run for an extended

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References