CVE-2026-46295

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Do IRR scan in _kvmapicupdateirr even if PIR is empty

Fall back to apicfindhighest_vector() when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR.

In a nested VM stress test, the following WARNING fires in vmxchecknestedevents() when kvmcpuhasinterrupt() reports a pending interrupt but the subsequent kvmapichasinterrupt() (which invokes vmxsyncpirto_irr() again) returns -1:

WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmxchecknestedevents+0x6bf/0x6e0 [kvmintel] Call Trace: kvmcheckandinjectevents vcpuenterguest.constprop.0 vcpurun kvmarchvcpuioctlrun kvmvcpu_ioctl __x64sysioctl dosyscall64 entrySYSCALL64afterhwframe

The root cause is a race between vmxsyncpirtoirr() on the target vCPU and _vmxdeliverpostedinterrupt() on a sender vCPU. The sender performs two individually-atomic operations that are not a single transaction:

1. pitestandsetpir(vector) -- sets the PIR bit
2. pitestandseton() -- sets PID.ON

The following interleaving triggers the bug:

Sender vCPU (IPI): Target vCPU (1st syncpirtoirr): B1: set PIR[vector] A1: piclearon() A2: piharvestpir() -> sees B1 bit A3: xchg() -> consumes bit, PIR=0 (1st sync returns correct maxirr) B2: set PID.ON = 1

                              Target vCPU (2nd sync_pir_to_irr):
                              C1: pi_test_on() -> TRUE (from B2)
                              C2: pi_clear_on() -> ON=0
                              C3: pi_harvest_pir() -> PIR empty
                              C4: *max_irr = -1, early return
                                  IRR NOT SCANNED

The interrupt is not lost (it resides in the IRR from the first sync and is recovered on the next vcpuenterguest() iteration), but the incorrect max_irr causes a spurious WARNING and a wasted L2 VM-Enter/VM-Exit cycle.