XSA-472 Reference TSC page leak

Advisory: XSA-472

Handling of the reference TSC page is racy, which can lead to the page being freed while still being part of the guest p2m.

See also

tests/xsa-472-3/main.c