Host crash via recursive VMGEXIT stack overflow

Race condition in Linux KVM SEV-ES and SEV-SNP allows guest OS users to crash the host through concurrent VMGEXIT handling. The handler reads guest-controlled GHCB fields more than once, allowing concurrent vCPUs to change values between checks and recursively reenter the handler until its kernel stack overflows. Exploitation requires a multi-vCPU SEV-ES or SEV-SNP guest; the vendor reports host escape as theoretical and limited to kernels without CONFIG_VMAP_STACK.