{"api_version":"1","generated_at":"2026-11-06T07:23:50+00:00","cve":"CVE-2022-49932","urls":{"html":"https://cve.report/CVE-2022-49932","api":"https://cve.report/api/cve/CVE-2022-49932.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-49932","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-49932"},"summary":{"title":"KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace\n\nCall kvm_init() only after _all_ setup is complete, as kvm_init() exposes\n/dev/kvm to userspace and thus allows userspace to create VMs (and call\nother ioctls).  E.g. KVM will encounter a NULL pointer when attempting to\nadd a vCPU to the per-CPU loaded_vmcss_on_cpu list if userspace is able to\ncreate a VM before vmx_init() configures said list.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP\n CPU: 6 PID: 1143 Comm: stable Not tainted 6.0.0-rc7+ #988\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vmx_vcpu_load_vmcs+0x68/0x230 [kvm_intel]\n  <TASK>\n  vmx_vcpu_load+0x16/0x60 [kvm_intel]\n  kvm_arch_vcpu_load+0x32/0x1f0 [kvm]\n  vcpu_load+0x2f/0x40 [kvm]\n  kvm_arch_vcpu_create+0x231/0x310 [kvm]\n  kvm_vm_ioctl+0x79f/0xe10 [kvm]\n  ? handle_mm_fault+0xb1/0x220\n  __x64_sys_ioctl+0x80/0xb0\n  do_syscall_64+0x2b/0x50\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n RIP: 0033:0x7f5a6b05743b\n  </TASK>\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel(+) kvm irqbypass","state":"PUBLISHED","assigner":"Linux","published_at":"2025-05-02 16:15:22","updated_at":"2026-11-05 20:17:18"},"problem_types":["CWE-476"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/e136e969d268b9b89329c816c002e53f60e82985","name":"https://git.kernel.org/stable/c/e136e969d268b9b89329c816c002e53f60e82985","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e32b120071ea114efc0b4ddd439547750b85f618","name":"https://git.kernel.org/stable/c/e32b120071ea114efc0b4ddd439547750b85f618","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e28533c08023c4b319b7f2cd77f3f7c9204eb517","name":"https://git.kernel.org/stable/c/e28533c08023c4b319b7f2cd77f3f7c9204eb517","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-49932","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49932","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dbef2808af6c594922fe32833b30f55f35e9da6d e136e969d268b9b89329c816c002e53f60e82985 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dbef2808af6c594922fe32833b30f55f35e9da6d e28533c08023c4b319b7f2cd77f3f7c9204eb517 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dbef2808af6c594922fe32833b30f55f35e9da6d e32b120071ea114efc0b4ddd439547750b85f618 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b2f7d0adc1260fa33ff3e992d18ff15873e68a67 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2c0bf2560ca18abe1451db23b8ef8700c67cc44f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f9971a898a815c2a6cce2932e91a576b28ed4cce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 40888c31aca3a46f266f1f121679f8e1982df085 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cd3f438fbb9cb60da32dd2b665f7dc9baba1c4ad git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e35a2dc8c7f664ae8a9cc46d19985dc79bfc1083 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9.220 4.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14.177 4.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.19.116 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.33 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.5.18 5.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.6.5 5.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.20 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2.7 6.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"49932","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2022-49932","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:51:38.282450Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T20:00:11.780Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/vmx/vmx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e136e969d268b9b89329c816c002e53f60e82985","status":"affected","version":"dbef2808af6c594922fe32833b30f55f35e9da6d","versionType":"git"},{"lessThan":"e28533c08023c4b319b7f2cd77f3f7c9204eb517","status":"affected","version":"dbef2808af6c594922fe32833b30f55f35e9da6d","versionType":"git"},{"lessThan":"e32b120071ea114efc0b4ddd439547750b85f618","status":"affected","version":"dbef2808af6c594922fe32833b30f55f35e9da6d","versionType":"git"},{"status":"affected","version":"b2f7d0adc1260fa33ff3e992d18ff15873e68a67","versionType":"git"},{"status":"affected","version":"2c0bf2560ca18abe1451db23b8ef8700c67cc44f","versionType":"git"},{"status":"affected","version":"f9971a898a815c2a6cce2932e91a576b28ed4cce","versionType":"git"},{"status":"affected","version":"40888c31aca3a46f266f1f121679f8e1982df085","versionType":"git"},{"status":"affected","version":"cd3f438fbb9cb60da32dd2b665f7dc9baba1c4ad","versionType":"git"},{"status":"affected","version":"e35a2dc8c7f664ae8a9cc46d19985dc79bfc1083","versionType":"git"},{"lessThan":"4.10","status":"affected","version":"4.9.220","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.177","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.116","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.33","versionType":"semver"},{"lessThan":"5.6","status":"affected","version":"5.5.18","versionType":"semver"},{"lessThan":"5.7","status":"affected","version":"5.6.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/vmx/vmx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.20","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.20","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2.7","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.220","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.177","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.116","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace\n\nCall kvm_init() only after _all_ setup is complete, as kvm_init() exposes\n/dev/kvm to userspace and thus allows userspace to create VMs (and call\nother ioctls).  E.g. KVM will encounter a NULL pointer when attempting to\nadd a vCPU to the per-CPU loaded_vmcss_on_cpu list if userspace is able to\ncreate a VM before vmx_init() configures said list.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP\n CPU: 6 PID: 1143 Comm: stable Not tainted 6.0.0-rc7+ #988\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vmx_vcpu_load_vmcs+0x68/0x230 [kvm_intel]\n  <TASK>\n  vmx_vcpu_load+0x16/0x60 [kvm_intel]\n  kvm_arch_vcpu_load+0x32/0x1f0 [kvm]\n  vcpu_load+0x2f/0x40 [kvm]\n  kvm_arch_vcpu_create+0x231/0x310 [kvm]\n  kvm_vm_ioctl+0x79f/0xe10 [kvm]\n  ? handle_mm_fault+0xb1/0x220\n  __x64_sys_ioctl+0x80/0xb0\n  do_syscall_64+0x2b/0x50\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n RIP: 0033:0x7f5a6b05743b\n  </TASK>\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel(+) kvm irqbypass"}],"providerMetadata":{"dateUpdated":"2026-05-23T15:23:17.642Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e136e969d268b9b89329c816c002e53f60e82985"},{"url":"https://git.kernel.org/stable/c/e28533c08023c4b319b7f2cd77f3f7c9204eb517"},{"url":"https://git.kernel.org/stable/c/e32b120071ea114efc0b4ddd439547750b85f618"}],"title":"KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2022-49932","datePublished":"2025-05-02T15:54:53.215Z","dateReserved":"2025-05-01T14:05:17.254Z","dateUpdated":"2026-11-05T20:00:11.780Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-05-02 16:15:22","lastModifiedDate":"2026-11-05 20:17:18","problem_types":["CWE-476"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-05T19:51:38.282450Z","id":"CVE-2022-49932","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.20","matchCriteriaId":"2B06CA9A-19CF-4C9A-AC5F-E30660581E22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.2.7","matchCriteriaId":"EFEDDF17-189C-4901-BD6B-41752E80AAA4"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"49932","Ordinal":"1","Title":"KVM: VMX: Do _all_ initialization before exposing /dev/kvm to us","CVE":"CVE-2022-49932","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"49932","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace\n\nCall kvm_init() only after _all_ setup is complete, as kvm_init() exposes\n/dev/kvm to userspace and thus allows userspace to create VMs (and call\nother ioctls).  E.g. KVM will encounter a NULL pointer when attempting to\nadd a vCPU to the per-CPU loaded_vmcss_on_cpu list if userspace is able to\ncreate a VM before vmx_init() configures said list.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP\n CPU: 6 PID: 1143 Comm: stable Not tainted 6.0.0-rc7+ #988\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vmx_vcpu_load_vmcs+0x68/0x230 [kvm_intel]\n  <TASK>\n  vmx_vcpu_load+0x16/0x60 [kvm_intel]\n  kvm_arch_vcpu_load+0x32/0x1f0 [kvm]\n  vcpu_load+0x2f/0x40 [kvm]\n  kvm_arch_vcpu_create+0x231/0x310 [kvm]\n  kvm_vm_ioctl+0x79f/0xe10 [kvm]\n  ? handle_mm_fault+0xb1/0x220\n  __x64_sys_ioctl+0x80/0xb0\n  do_syscall_64+0x2b/0x50\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n RIP: 0033:0x7f5a6b05743b\n  </TASK>\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel(+) kvm irqbypass","Type":"Description","Title":"KVM: VMX: Do _all_ initialization before exposing /dev/kvm to us"}]}}}