Linux Kernel KVM EUVD-2026-59183

Paravirtual EOI (PV EOI) is a KVM performance optimization for x86 Local APIC emulation that allows guest VMs to acknowledge interrupts via a shared guest-host memory region, avoiding a full VM exit per EOI. The affected code path is in kvm_lapic_sync_from_vapic() within arch/x86/kvm/lapic.c. When a pending PV EOI service request is outstanding, KVM calls pv_eoi_test_and_clr_pending(), which internally calls pv_eoi_get_user() to read the guest-shared memory region. If that memory read fails and the function returns early, yet the vCPU subsequently disables PV EOI via its MSR, a subsequent assertion that PV EOI must still be enabled fires as a kernel BUG. The root cause is a TOCTOU-class logic error (closest to CWE-617, Reachable Assertion): the pending-service flag and the PV EOI enabled state are checked at different points without re-validation, allowing an inconsistent intermediate state to reach a hard assertion. CPE data (cpe:2.3:a:linux:linux:*) confirms this affects the Linux kernel broadly. PV EOI support was introduced in Linux 3.6, which defines the earliest affected version. The crash backtrace names the KVM Intel module (kvm_intel, kvm) and the test reproducer pv_eoi_test run by a non-privileged UID.