The issue is caused by a conflicting use of HSTATE HOST R1 to store r1 state in kvmppc hv entry plus in kvmppc {save,restore} tm, leading to a stack corruption. An attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic. The vulnerability was introduced by two commits that landed in versions 4.8 and 4.17.