LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49884: KVM: Initialize gfn_to_pfn_cache locks in dedicated helper

In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfn_to_pfn_cache locks in dedicated helper Move the gfn_to_pfn_cache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvm_gfn_to_pfn_cache_init()'s ability to re-initialize the cache's locks. For example: a race between ioctl(KVM_XEN_HVM_EVTCHN_SEND) and kvm_gfn_to_pfn_cache_init() leads to a corrupted shinfo gpc lock. (thread 1) | (thread 2) | kvm_xen_set_evtchn_fast | read_lock_irqsave(&gpc->lock, ...) | | kvm_gfn_to_pfn_cache_init | rwlock_init(&gpc->lock) read_unlock_irqrestore(&gpc->lock, ...) | Rename "cache_init" and "cache_destroy" to activate+deactivate to avoid implying that the cache really is destroyed/freed. Note, there more races in the newly named kvm_gpc_activate() that will be addressed separately. [sean: call out that this is a bug fix]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a race condition in KVM, the virtualization subsystem. Under specific KVM/Xen event-channel handling, a lock could be reinitialized while in use, corrupting internal state. The source bundle does not provide CVSS, impact details, or evidence of exploitation, so business urgency depends on whether affected kernels run virtualization workloads.

Executive priority

Treat this as a virtualization-host patching item with incomplete severity data. Prioritize kernel update planning for KVM infrastructure, but avoid emergency escalation unless vendor advisories identify higher impact or local exposure is broad.

Technical view

The fix moves gfn_to_pfn_cache lock initialization into a dedicated helper called during VM/vCPU creation. The vulnerable behavior allowed kvm_gfn_to_pfn_cache_init() to reinitialize locks during active use, including a cited race with ioctl(KVM_XEN_HVM_EVTCHN_SEND), corrupting the shinfo gpc lock.

Likely exposure

Exposure is most relevant to Linux hosts running KVM, especially environments using KVM Xen compatibility paths. The bundle lists Linux kernel versions including 5.17, 6.0.8, and 6.1 as affected, but exact distribution package ranges require vendor mapping.

Exploitation context

The sources describe a race condition and a bug fix, not an active attack. KEV status is false, and no cited source in the bundle reports exploitation in the wild, exploit availability, or attacker prerequisites.

Researcher notes

The record identifies lock reinitialization races in KVM gfn_to_pfn_cache handling and notes more races in kvm_gpc_activate() were to be addressed separately. The provided data lacks CVSS, CWE, exploit status, and concrete impact beyond lock corruption.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Check distribution vendor advisories for affected package versions and reboot requirements.
  • Prioritize KVM virtualization hosts over non-virtualization Linux systems.
  • Limit untrusted access to VM management interfaces while awaiting vendor guidance.

Validation and detection

  • Inventory Linux kernel versions on KVM hosts and virtualization clusters.
  • Map running distribution packages to vendor advisories for CVE-2022-49884.
  • Confirm whether deployed kernels include the referenced stable commits.
  • Document systems not using KVM as lower-priority exposure pending vendor confirmation.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49884 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux982ed0de4753ed6e71dbd40f82a5a066baf133ed, 982ed0de4753ed6e71dbd40f82a5a066baf133edunaffected
LinuxLinux5.17, 0, 6.0.8, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.