[x86] Backport security fixes for KVM

Ben Hutchingsrequested to merge
benh/linux:CVE-2026-53359-5.10 into debian/5.10/bullseye-security

Backport the fixes for CVE-2026-46113 and CVE-2026-53359, with a long chain of dependencies.

  • KVM: X86: Synchronize the shadow pagetable before link it
  • KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation
  • KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct
  • KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes
  • KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction
  • KVM: x86/mmu: Optimize MMU page cache lookup for all direct SPs
  • KVM: x86/mmu: Use a bool for direct
  • KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root()
  • KVM: x86/mmu: Derive shadow MMU page role from parent
  • KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page()
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
  • KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

This is completely untested so far.

Merge request reports