GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49154 (GCVE-0-2022-49154)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-08-05 08:54
VLAI
Title
KVM: SVM: fix panic on out-of-bounds guest IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: fix panic on out-of-bounds guest IRQ As guest_irq is coming from KVM_IRQFD API call, it may trigger crash in svm_update_pi_irte() due to out-of-bounds: crash> bt PID: 22218 TASK: ffff951a6ad74980 CPU: 73 COMMAND: "vcpu8" #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397 #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9 #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51 #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace [exception RIP: svm_update_pi_irte+227] RIP: ffffffffc0761b53 RSP: ffffb1ba6707fd08 RFLAGS: 00010086 RAX: ffffb1ba6707fd78 RBX: ffffb1ba66d91000 RCX: 0000000000000001 RDX: 00003c803f63f1c0 RSI: 000000000000019a RDI: ffffb1ba66db2ab8 RBP: 000000000000019a R8: 0000000000000040 R9: ffff94ca41b82200 R10: ffffffffffffffcf R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000001 R14: ffffffffffffffcf R15: 000000000000005f ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm] #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm] #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm] RIP: 00007f143c36488b RSP: 00007f143a4e04b8 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 00007f05780041d0 RCX: 00007f143c36488b RDX: 00007f05780041d0 RSI: 000000004008ae6a RDI: 0000000000000020 RBP: 00000000000004e8 R8: 0000000000000008 R9: 00007f05780041e0 R10: 00007f0578004560 R11: 0000000000000246 R12: 00000000000004e0 R13: 000000000000001a R14: 00007f1424001c60 R15: 00007f0578003bc0 ORIG_RAX: 0000000000000010 CS: 0033 SS: 002b Vmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on out-of-bounds guest IRQ), so we can just copy source from that to fix this.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 411b44ba80ab0023383fe3f377e903cb0cb7d8bb , < 0fb470eb48892e131d10aa3be6915239e65758f3 (git)
Affected: 411b44ba80ab0023383fe3f377e903cb0cb7d8bb , < 3fa2d747960521a646fc1aad7aea82e95e139a68 (git)
Affected: 411b44ba80ab0023383fe3f377e903cb0cb7d8bb , < e4d153d53d9648513481eb4ef8c212e7f1f8173d (git)
Affected: 411b44ba80ab0023383fe3f377e903cb0cb7d8bb , < a6ffdebfb6a9c2ffeed902b544b96fe67498210e (git)
Affected: 411b44ba80ab0023383fe3f377e903cb0cb7d8bb , < a80ced6ea514000d34bf1239d47553de0d1ee89e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 5.10.110 , ≤ 5.10.* (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/avic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fb470eb48892e131d10aa3be6915239e65758f3",
              "status": "affected",
              "version": "411b44ba80ab0023383fe3f377e903cb0cb7d8bb",
              "versionType": "git"
            },
            {
              "lessThan": "3fa2d747960521a646fc1aad7aea82e95e139a68",
              "status": "affected",
              "version": "411b44ba80ab0023383fe3f377e903cb0cb7d8bb",
              "versionType": "git"
            },
            {
              "lessThan": "e4d153d53d9648513481eb4ef8c212e7f1f8173d",
              "status": "affected",
              "version": "411b44ba80ab0023383fe3f377e903cb0cb7d8bb",
              "versionType": "git"
            },
            {
              "lessThan": "a6ffdebfb6a9c2ffeed902b544b96fe67498210e",
              "status": "affected",
              "version": "411b44ba80ab0023383fe3f377e903cb0cb7d8bb",
              "versionType": "git"
            },
            {
              "lessThan": "a80ced6ea514000d34bf1239d47553de0d1ee89e",
              "status": "affected",
              "version": "411b44ba80ab0023383fe3f377e903cb0cb7d8bb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/avic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: fix panic on out-of-bounds guest IRQ\n\nAs guest_irq is coming from KVM_IRQFD API call, it may trigger\ncrash in svm_update_pi_irte() due to out-of-bounds:\n\ncrash\u003e bt\nPID: 22218  TASK: ffff951a6ad74980  CPU: 73  COMMAND: \"vcpu8\"\n #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397\n #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d\n #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d\n #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d\n #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9\n #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51\n #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace\n    [exception RIP: svm_update_pi_irte+227]\n    RIP: ffffffffc0761b53  RSP: ffffb1ba6707fd08  RFLAGS: 00010086\n    RAX: ffffb1ba6707fd78  RBX: ffffb1ba66d91000  RCX: 0000000000000001\n    RDX: 00003c803f63f1c0  RSI: 000000000000019a  RDI: ffffb1ba66db2ab8\n    RBP: 000000000000019a   R8: 0000000000000040   R9: ffff94ca41b82200\n    R10: ffffffffffffffcf  R11: 0000000000000001  R12: 0000000000000001\n    R13: 0000000000000001  R14: ffffffffffffffcf  R15: 000000000000005f\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm]\n #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm]\n #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm]\n    RIP: 00007f143c36488b  RSP: 00007f143a4e04b8  RFLAGS: 00000246\n    RAX: ffffffffffffffda  RBX: 00007f05780041d0  RCX: 00007f143c36488b\n    RDX: 00007f05780041d0  RSI: 000000004008ae6a  RDI: 0000000000000020\n    RBP: 00000000000004e8   R8: 0000000000000008   R9: 00007f05780041e0\n    R10: 00007f0578004560  R11: 0000000000000246  R12: 00000000000004e0\n    R13: 000000000000001a  R14: 00007f1424001c60  R15: 00007f0578003bc0\n    ORIG_RAX: 0000000000000010  CS: 0033  SS: 002b\n\nVmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on\nout-of-bounds guest IRQ), so we can just copy source from that to fix\nthis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local KVM VM ioctls (KVM_IRQFD / KVM_SET_GSI_ROUTING \u2192 kvm_irq_routing_update \u2192 avic_pi_update_irte) on /dev/kvm; it does not process network packets or remote protocol data.\nAC:L - An attacker who can open /dev/kvm fully controls the GSI/irqfd values and routing-update sequence and can deterministically force guest_irq \u003e= nr_rt_entries on AMD hosts with IRQ posting; no race or attacker-uncontrollable layout is required for the crash path.\nPR:L - /dev/kvm is mode 0660 group kvm (with uaccess); unprivileged users in the kvm group\u2014or cloud tenants running QEMU with VFIO passthrough\u2014can exercise the path without real init-namespace root, matching the related CVE-2017-1000252 PR:L assessment.\nUI:N - The attacker triggers the fault entirely with their own KVM ioctls; no separate victim mount, open, or other interactive action is required.\nS:U - This is a host-userspace VMM ioctl hitting the host kernel, not a guest-to-host escape; impact stays in the same OS/kernel authority (standard local kernel DoS/corruption), unlike a true KVM VM-escape Scope Changed case.\nC:H - WARN_ON does not stop execution, so an attacker-chosen guest_irq performs an unbounded out-of-bounds read of irq_rt-\u003emap[] heap memory as an hlist_head and may walk/treat adjacent objects as kvm_kernel_irq_routing_entry structures, which per guidance is High confidentiality impact.\nI:H - A successful forged-entry walk can drive irq_set_vcpu_affinity and svm_ir_list_add/del on attacker-influenced routing/IOMMU state (type confusion / list mutation from OOB-derived pointers), which is High integrity impact under the overestimate rule.\nA:H - The documented failure is an exc_page_fault / machine check path through svm_update_pi_irte leading to oops/panic (and host hang in the related VMX BUG_ON case), which is full availability impact and can be retried."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:05.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0fb470eb48892e131d10aa3be6915239e65758f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fa2d747960521a646fc1aad7aea82e95e139a68"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4d153d53d9648513481eb4ef8c212e7f1f8173d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6ffdebfb6a9c2ffeed902b544b96fe67498210e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a80ced6ea514000d34bf1239d47553de0d1ee89e"
        }
      ],
      "title": "KVM: SVM: fix panic on out-of-bounds guest IRQ",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49154",
    "datePublished": "2025-02-26T01:55:19.245Z",
    "dateReserved": "2025-02-26T01:49:39.275Z",
    "dateUpdated": "2026-08-05T08:54:05.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49154",
      "date": "2026-09-16",
      "epss": "0.00277",
      "percentile": "0.20246"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49154\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:52.627\",\"lastModified\":\"2026-08-04T10:17:36.600\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SVM: fix panic on out-of-bounds guest IRQ\\n\\nAs guest_irq is coming from KVM_IRQFD API call, it may trigger\\ncrash in svm_update_pi_irte() due to out-of-bounds:\\n\\ncrash\u003e bt\\nPID: 22218  TASK: ffff951a6ad74980  CPU: 73  COMMAND: \\\"vcpu8\\\"\\n #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397\\n #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d\\n #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d\\n #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d\\n #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9\\n #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51\\n #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace\\n    [exception RIP: svm_update_pi_irte+227]\\n    RIP: ffffffffc0761b53  RSP: ffffb1ba6707fd08  RFLAGS: 00010086\\n    RAX: ffffb1ba6707fd78  RBX: ffffb1ba66d91000  RCX: 0000000000000001\\n    RDX: 00003c803f63f1c0  RSI: 000000000000019a  RDI: ffffb1ba66db2ab8\\n    RBP: 000000000000019a   R8: 0000000000000040   R9: ffff94ca41b82200\\n    R10: ffffffffffffffcf  R11: 0000000000000001  R12: 0000000000000001\\n    R13: 0000000000000001  R14: ffffffffffffffcf  R15: 000000000000005f\\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\\n #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm]\\n #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm]\\n #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm]\\n    RIP: 00007f143c36488b  RSP: 00007f143a4e04b8  RFLAGS: 00000246\\n    RAX: ffffffffffffffda  RBX: 00007f05780041d0  RCX: 00007f143c36488b\\n    RDX: 00007f05780041d0  RSI: 000000004008ae6a  RDI: 0000000000000020\\n    RBP: 00000000000004e8   R8: 0000000000000008   R9: 00007f05780041e0\\n    R10: 00007f0578004560  R11: 0000000000000246  R12: 00000000000004e0\\n    R13: 000000000000001a  R14: 00007f1424001c60  R15: 00007f0578003bc0\\n    ORIG_RAX: 0000000000000010  CS: 0033  SS: 002b\\n\\nVmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on\\nout-of-bounds guest IRQ), so we can just copy source from that to fix\\nthis.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: SVM: se corrige el p\u00e1nico en la IRQ de invitado fuera de los l\u00edmites Como guest_irq proviene de la llamada API KVM_IRQFD, puede provocar un bloqueo en svm_update_pi_irte() debido a fuera de los l\u00edmites: crash\u0026gt; bt PID: 22218 TAREA: ffff951a6ad74980 CPU: 73 COMANDO: \\\"vcpu8\\\" #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397 #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d #3 [ffffb1ba6707fb70] oops_end en ffffffff85623c0d #4 [ffffb1ba6707fb90] no_context en ffffffff856692c9 #5 [ffffb1ba6707fbf8] exc_page_fault en ffffffff85f95b51 #6 [ffffb1ba6707fc50] asm_exc_page_fault en ffffffff86000ace [excepci\u00f3n RIP: svm_update_pi_irte+227] RIP: ffffffffc0761b53 RSP: ffffb1ba6707fd08 RFLAGS: 00010086 RAX: ffffb1ba6707fd78 RBX: ffffb1ba66d91000 RCX: 0000000000000001 RDX: 00003c803f63f1c0 RSI: 000000000000019a RDI: ffffb1ba66db2ab8 RBP: 000000000000019a R8: 0000000000000040 R9: ffff94ca41b82200 R10: ffffffffffffffcf R11: 0000000000000001 R12: 00000000000000001 R13: 0000000000000001 R14: ffffffffffffffcf R15: 0000000000000005f ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb1ba6707fdb8] actualizaci\u00f3n de enrutamiento irq kvm en ffffffffc09f19a1 [kvm] #8 [ffffb1ba6707fde0] enrutamiento irq kvm_establecido en ffffffffc09f2133 [kvm] #9 [ffffb1ba6707fe18] kvm_vm_ioctl en ffffffffc09ef544 [kvm] RIP: 00007f143c36488b RSP: 00007f143a4e04b8 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 00007f05780041d0 RCX: 00007f143c36488b RDX: 00007f05780041d0 RSI: 000000004008ae6a RDI: 0000000000000020 RBP: 00000000000004e8 R8: 0000000000000008 R9: 00007f05780041e0 R10: 00007f0578004560 R11: 0000000000000246 R12: 00000000000004e0 R13: 000000000000001a R14: 00007f1424001c60 R15: 00007f0578003bc0 ORIG_RAX: 0000000000000010 CS: 0033 SS: 002b Vmx ha solucionado esto en el commit 3a8b0677fc61 (KVM: VMX: No BUG() en IRQ de invitado fuera de los l\u00edmites), por lo que podemos simplemente copiar la fuente de all\u00ed para solucionarlo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/avic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"411b44ba80ab0023383fe3f377e903cb0cb7d8bb\",\"lessThan\":\"0fb470eb48892e131d10aa3be6915239e65758f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"411b44ba80ab0023383fe3f377e903cb0cb7d8bb\",\"lessThan\":\"3fa2d747960521a646fc1aad7aea82e95e139a68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"411b44ba80ab0023383fe3f377e903cb0cb7d8bb\",\"lessThan\":\"e4d153d53d9648513481eb4ef8c212e7f1f8173d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"411b44ba80ab0023383fe3f377e903cb0cb7d8bb\",\"lessThan\":\"a6ffdebfb6a9c2ffeed902b544b96fe67498210e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"411b44ba80ab0023383fe3f377e903cb0cb7d8bb\",\"lessThan\":\"a80ced6ea514000d34bf1239d47553de0d1ee89e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/avic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.110\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"5.10.110\",\"matchCriteriaId\":\"2846E51C-65CF-4CDD-BDDD-B682E3E6F21C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"27C42AE8-B387-43E2-938A-E1C8B40BE6D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0fb470eb48892e131d10aa3be6915239e65758f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3fa2d747960521a646fc1aad7aea82e95e139a68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6ffdebfb6a9c2ffeed902b544b96fe67498210e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a80ced6ea514000d34bf1239d47553de0d1ee89e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e4d153d53d9648513481eb4ef8c212e7f1f8173d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T18:43:22+00:00",
      "cve": "CVE-2022-49154",
      "id": "CVE-2022-49154",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SVM: fix panic on out-of-bounds guest IRQ",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49154.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-06T23:47:59Z",
      "cve": "CVE-2022-49154",
      "id": "CVE-2022-49154",
      "initial_release_date": "2025-02-27T03:11:26Z",
      "product_status:known_affected": "512",
      "product_status:known_not_affected": "222",
      "product_status:recommended": "260",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49154",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49154.json",
      "version": "58"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.