News › security
By The Linux Camp News, October 16, 2026
The proposed change connects userspace requests to TDX Module controls that KVM had left unwired. Its availability-protection role does not mean it will activate automatically.
Sean Christopherson submitted KVM changes targeting Linux 7.4 on October 16, 2026 UTC, including Instruction Timeout support for Intel Trust Domain Extensions, or TDX, virtual machines. The request carries an October 15 timestamp in the -0700 time zone. As of the October 16 source retrieval, the evidence establishes a pull request for queuing in the KVM tree, not a confirmed mainline merge or released fix. 2 1
The change repairs a missing connection rather than introducing a separate mitigation alongside Notify VM-Exits. Christopherson identifies Instruction Timeout as the documentation name for Notify VM-Exits and says KVM had omitted the TDX Module controls. With the proposed wiring, enabling the feature from userspace also enables it for TDX guests. The same integration change covers Bus Lock VM-Exits. 2
The operational concern is host availability. Phoronix describes a potential attack in which someone with access to a TDX-protected VM blocks interrupt or event handling, starving host resources or locking up a CPU core. That explains why a guest-side activity can matter to the server operator. This is the publication's description of a possible denial-of-service scenario, not an observed exploitation report or a measured guarantee of protection. 1
For TDX host operators, the practical inference is to verify both inclusion of the change in the running kernel and userspace enablement before treating the feature as active. Merely installing a kernel package would not establish either condition. This follows from the maintainer's explicit userspace requirement: kernel support supplies the missing connection, but does not establish an automatically enabled policy. 2
The pull-request summary does not specify the timeout trigger or threshold, subsequent exit handling, supported CPU and TDX Module versions, or the userspace interface and its defaults. Those gaps prevent a deployment recipe from this packet alone. Its stated scope is TDX guests; it does not establish whether non-TDX configurations face comparable availability risks. 2