CVE-2026-46295: KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Do IRR scan in kvmapicupdateirr even if PIR is empty

Fall back to apicfindhighestvector() when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR.

In a nested VM stress test, the following WARNING fires in vmxchecknestedevents() when kvmcpuhasinterrupt() reports a pending interrupt but the subsequent kvmapichasinterrupt() (which invokes vmxsyncpirtoirr() again) returns -1:

WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmxchecknestedevents+0x6bf/0x6e0 [kvmintel] Call Trace: kvmcheckandinjectevents vcpuenterguest.constprop.0 vcpurun kvmarchvcpuioctlrun kvmvcpuioctl x64sysioctl dosyscall64 entrySYSCALL64afterhwframe

The root cause is a race between vmxsyncpirtoirr() on the target vCPU and vmxdeliverpostedinterrupt() on a sender vCPU. The sender performs two individually-atomic operations that are not a single transaction:

1. pitestandsetpir(vector) -- sets the PIR bit 2. pitestandseton() -- sets PID.ON

The following interleaving triggers the bug:

Sender vCPU (IPI): Target vCPU (1st syncpirtoirr): B1: set PIR[vector] A1: piclearon() A2: piharvestpir() -> sees B1 bit A3: xchg() -> consumes bit, PIR=0 (1st sync returns correct maxirr) B2: set PID.ON = 1

Target vCPU (2nd syncpirtoirr): C1: piteston() -> TRUE (from B2) C2: piclearon() -> ON=0 C3: piharvestpir() -> PIR empty C4: maxirr = -1, early return IRR NOT SCANNED

The interrupt is not lost (it resides in the IRR from the first sync and is recovered on the next vcpuenterguest() iteration), but the incorrect maxirr causes a spurious WARNING and a wasted L2 VM-Enter/VM-Exit cycle.