Security readout for executives and security teams
Plain-English summary
CVE-2022-50851 is a Linux kernel crash bug in vhost_vdpa, a virtualization data-path component. In testing with vIOMMU, a guest unmapping very large memory could trigger a kernel BUG and crash the host kernel. The main business risk is availability impact on virtualization hosts using this feature.
Executive priority
Prioritize patch assessment for virtualization platforms hosting untrusted or multi-tenant guests. The likely impact is host availability, not confirmed data theft. Treat as urgent where vhost_vdpa is used, and routine-to-moderate elsewhere pending configuration validation.
Technical view
The issue occurs when vhost_vdpa handles large guest memory unmap requests. The fix adds vhost_vdpa_general_unmap(), limiting unmap operations to memory saved in the IOTLB. The provided trace shows qemu-system-x86 reaching vhost_vdpa_unmap, iommu_unmap, and intel_iommu_unmap_pages before a kernel BUG.
Likely exposure
Exposure appears limited to Linux virtualization hosts using vhost_vdpa with vIOMMU/IOMMU paths. General Linux servers not using this feature are less likely exposed. The affected-version data in the source bundle is incomplete and should be validated against distribution kernel packages.
Exploitation context
No cited source or KEV entry indicates active exploitation. The source describes a crash observed during testing when a guest unmapped very large memory. This suggests a potential denial-of-service condition from a guest against an affected host configuration, but public exploit status is not established.
Researcher notes
The record lacks CVSS, CWE, and clear normalized affected ranges. The source bundle names Linux kernel and stable commits, but version mapping should be confirmed per distribution. Avoid assuming all Linux deployments are affected; the described trigger depends on vhost_vdpa and vIOMMU/IOMMU behavior.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Prioritize virtualization hosts using vhost_vdpa and vIOMMU/IOMMU.
- Check your Linux distribution advisory for backported fixed packages.
- If immediate patching is not possible, request vendor-supported risk-reduction guidance.
Validation and detection
- Inventory hosts running Linux kernels with vhost_vdpa enabled or loaded.
- Identify workloads using vDPA devices with QEMU/KVM guests.
- Compare installed kernel packages against vendor advisories and referenced stable commits.
- Review kernel logs for vhost_vdpa_unmap or intel_iommu_unmap_pages crash traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50851 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.