Yes, exactly. I did not see anything in the vmm.ko load code which disabled preemption, and preemption can happen while pmap does an invalidation in the kernel pmap. We only pin the thread, we do not enter critical section there.
Of course, it is very bad luck to actually get it in real life. I did not, I just read the code.
BTW, there is another similar 'unlikely thing I saw in vmx_support.S. vmx_enter_guest uses stack space below the bottom to form the INVEPT descriptor. Until very recent time, we could get e.g. MCE executed on the thread stack with interrupts disabled. MCE was changed to use IST, but IMO we should be more careful. And, amd64 kernel does not use red zone.