Commit 03741bcea0a9 for kernel

commit 03741bcea0a9ec4c8f386fd5c6051c1a14070240
Merge: 24a19b953e2a e90ab3669181
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Oct 13 16:41:23 2026 -0700

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

    Pull kvm fixes from Paolo Bonzini:
     "More x86 fixes:

       - Fix a WARN if the SS bit is set in #NPF exit codes.

         The AMD manual is unclear about whether it can be set when the
         guest uses CET but the SupervisorShadowStackEn feature (which KVM
         does not use) is disabled. However, Hyper-V has started using CET
         now that KVM supports GMET (it wants the two feature in pairs), and
         that dissolves all the doubts: the SS bit *is* reported and not
         clearing it causes a WARN and/or a UBSAN splat.

       - If creating a vCPU ultimately fails, clear its entry in the AVIC
         Physical ID table used by hardware to perform IPI Virtualization
         and delivered posted IRQs.

         I.e. plug the same use-after-free hole related to IPI
         virtualization and posted IRQs that was fixed for APICv by commit
         b41f2ca6c0601 ("KVM: VMX: Fix stale PID-pointer table entry left
         after vCPU free").

       - Use set_page_dirty_lock() instead of set_page_dirty() when marking
         a page dirty after writing back SNP firmware's desired CPUID state
         to userspace.

         Using set_page_dirty() is unsafe if the page/folio isn't locked (as
         pointed out by its function comment's big DANGER warning, which no
         one reads given the number of bugs of this exact nature).

       - When checking for an MMIO generation match, use the memslots for
         the current vCPU context (non-SMM vs. SMM), as a misbehaving guest
         can coerce KVM into incorrectly identifying a write as MMIO in
         order to bypass KVM's write-tracking"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
      KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
      KVM: x86: Use active memslots for the per-vCPU MMIO cache
      KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
      KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails
      KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()
      KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable