ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2022-49882

KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache

Published May 1, 2025 · catalog updated Oct 15, 2026 · Linux Linux

Check this week

CVE-2022-49882 is not in CISA KEV. FIRST estimates a 19.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
19.00%
Remediation
Version ranges on file
Affected products
cpe linux/linux kernel · vendor Linux Linux · vendor Linux Linux 982ed0de4753ed6e71dbd40f82a5a066baf133ed <ecbcf030b45666ad11bc98565e71dfbcb7be4393

In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid, inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL kernel pointer or missing an mmu_notifier invalidation due to the cache not being on the list of gfns to invalidate. Note, "active" needs to be set if and only if the cache is on the list of caches, i.e. is reachable via mmu_notifier events. If a relevant mmu_notifier event occurs while the cache is "active" but not on the list, KVM will not acquire the cache's lock and so will not serailize the mmu_notifier event with active users and/or kvm_gpc_refresh(). A race between KVM_XEN_ATTR_TYPE_SHARED_INFO and KVM_XEN_HVM_EVTCHN_SEND can be exploited to trigger the bug. 1. Deactivate shinfo cache: kvm_xen_hvm_set_attr case KVM_XEN_ATTR_TYPE_SHARED_INFO kvm_gpc_deactivate kvm_gpc_unmap gpc->valid = false gpc->khva = NULL gpc->active = false Result: active = false, valid = false 2. Cause cache refresh: kvm_arch_vm_ioctl case KVM_XEN_HVM_EVTCHN_SEND kvm_xen_hvm_evtchn_send kvm_xen_set_evtchn kvm_xen_set_evtchn_fast kvm_gpc_check return -EWOULDBLOCK because !gpc->valid kvm_xen_set_evtchn_fast return -EWOULDBLOCK kvm_gpc_refresh hva_to_pfn_retry gpc->valid = true gpc->khva = not NULL Result: active = false, valid = true 3. Race ioctl KVM_XEN_HVM_EVTCHN_SEND against ioctl KVM_XEN_ATTR_TYPE_SHARED_INFO: kvm_arch_vm_ioctl case KVM_XEN_HVM_EVTCHN_SEND kvm_xen_hvm_evtchn_send kvm_xen_set_evtchn kvm_xen_set_evtchn_fast read_lock gpc->lock kvm_xen_hvm_set_attr case KVM_XEN_ATTR_TYPE_SHARED_INFO mutex_lock kvm->lock kvm_xen_shared_info_init kvm_gpc_activate gpc->khva = NULL kvm_gpc_check [ Check passes because gpc->valid is still true, even though gpc->khva is already NULL. ] shinfo = gpc->

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe linux/linux kernel6.1
  • vendor Linux Linuxversion unspecified
  • vendor Linux Linux 982ed0de4753ed6e71dbd40f82a5a066baf133ed <ecbcf030b45666ad11bc98565e71dfbcb7be4393982ed0de4753ed6e71dbd40f82a5a066baf133ed <ecbcf030b45666ad11bc98565e71dfbcb7be4393

How to fix CVE-2022-49882

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2022-49882 is not in CISA KEV. FIRST estimates a 19.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Which versions are affected?

Compare what you have installed with linux/linux kernel 6.1; Linux Linux 982ed0de4753ed6e71dbd40f82a5a066baf133ed <ecbcf030b45666ad11bc98565e71dfbcb7be4393 982ed0de4753ed6e71dbd40f82a5a066baf133ed <ecbcf030b45666ad11bc98565e71dfbcb7be4393. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-416: Use After Free. EPSS 19.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 1, 2025 · CIRCL Vulnerability Lookup

    Detected

    In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid, inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL

  2. Oct 15, 2026 · CIRCL Vulnerability Lookup

    Updated

    In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid, inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL

  3. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a valid, inactive cache, which can lead to a variety of use-after-free bugs, e.g. consuming a NULL

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2022-49882

    In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, a

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2022-49882

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-49882

    30-day exploitation probability 19.0%

    first.org
  • EUVDVulnerability recordEUVD-2025-12889

    In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious, a

    euvd.enisa.europa.eu
  • NIST NVDVulnerability recordCVE-2022-49882

    In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is particularly egregious,

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.