Executive brief
The Linux kernel's KVM hypervisor contains a flaw in its Hyper-V synthetic timer emulation that allows a guest or administrator to program a timer deadline in the past through integer overflow. This causes the CPU to enter an infinite loop repeatedly re-arming the timer, effectively starving the system and preventing normal operation, with particular impact on systems running real-time priority tasks.
Technical details
The vulnerability exists in KVM's Hyper-V SynIC timer implementation (stimer_start() function), where a deadline calculation can overflow when COUNT is set to a value near U64_MAX. Specifically, the expression ktime_add_ns(ktime_now, 100 * (stimer->exp_time - time_now)) can overflow, resulting in a past-due deadline. When an hrtimer is armed with a deadline in the past, it fires immediately, raising KVM_RQ_HV_STIMER. The stimer_expiration() comparison uses an extremely large exp_time value (near U64_MAX), causing the deadline check to never succeed for thousands of years, so the timer remains armed. This triggers a livelock loop in vcpu_enter_guest() where the timer repeatedly fires and re-arms before guest entry, consuming all CPU cycles and starving RCU grace-period kthreads. The vulnerability is reachable from userspace via KVM_SET_MSRS or from the guest via WRMSR to HV_X64_MSR_STIMERi_CONFIG/COUNT MSRs. A fix is available that clamps the deadline calculation to the current time if overflow is detected.
Affected products
- Linux Linux kernel affected versions prior to fix
Timeline
- 2026-09-16: disclosed
- patched: fix available in Linux kernel upstream