CVE-2025-71104: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71104 is a Linux kernel KVM vulnerability that causes host hard lockups when a virtual machine using a periodic APIC timer (via the Intel VMX preemption/HV timer) is paused or suspended for an extended duration and then resumed. The flaw was published on January 14, 2026, and affects multiple Linux kernel versions spanning from 4.14.45 through 6.18.x and 6.19 release candidates. Affected version ranges include: 4.14.45–4.15, 4.16.13–4.17, 4.17.1–5.10.248, 5.11–5.15.198, 5.16–6.1.160, 6.2–6.6.120, 6.7–6.12.64, and 6.13–6.18.3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is classified as CWE-667 (Improper Locking) and stems from incorrect timer expiration advancement logic in the KVM x86 APIC timer subsystem. When a guest vCPU resumes after a prolonged pause, the advance_periodic_target_expiration() function blindly adds one period to the previous (now stale) target expiration rather than resetting to "now," resulting in a target expiration that is still in the past. This causes a negative delta when computing the next deadline; when cast to an unsigned 64-bit value (tscdeadline), the result overflows the VMX Preemption Timer's maximum bit width (cpu_preemption_timer_multi + 32), forcing KVM to fall back from the HV timer to the software hrtimer. The hrtimer then repeatedly re-invokes KVM's callback for past-due expirations within a single IRQ-disabled clock interrupt handler, spinning until a hard lockup is triggered (Feedly). The bug is specific to Intel CPUs using the VMX preemption timer, as the software hrtimer continues running during userspace exits while the HV timer does not.

Successful triggering of this vulnerability causes a hard lockup on the affected host CPU core, rendering the entire host system unresponsive and disrupting all workloads running on it. There is no confidentiality or integrity impact; the sole consequence is a complete availability loss (denial of service) for the host. In production virtualization environments, this can affect all guest VMs co-located on the impacted host, not just the VM that triggered the lockup (Feedly).

• Logs/Console: NMI watchdog messages such as NMI watchdog: Watchdog detected hard LOCKUP on cpu <N> in kernel logs or serial console output.
• Kernel Stack Trace: Call stack showing advance_periodic_target_expiration+0x4d/0x80 [kvm] → apic_timer_fn → __hrtimer_run_queues → hrtimer_interrupt → smp_apic_timer_interrupt in crash dumps or kdump captures.
• System Behavior: Host becomes completely unresponsive (no SSH, no console response) following a VM resume from a long pause/suspend on an Intel KVM host.
• KVM Module: Presence of the kvm and kvm_intel kernel modules loaded on an Intel host running affected kernel versions with guest VMs using periodic APIC timers.

Apply the upstream kernel patches available via git.kernel.org for the relevant stable branches (commits: 18ab3fc8, 786ed625, 7b54ccef, 807dbe8f, d2da0df7, e23f46f1, e746e519). Target patched versions are: 4.15+, 4.17+, 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.3+ depending on the running branch (Feedly). Distribution-specific updates have been released by Debian (linux 6.1.162-1, 5.10.249-1), Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), Oracle Linux, and SUSE. As a temporary workaround where patching is not immediately possible, avoid pausing or suspending VMs for extended durations on Intel KVM hosts, or disable the VMX preemption timer via the kvm_intel module parameter preemption_timer=0 to force use of the software hrtimer exclusively.