GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48765 (GCVE-0-2022-48765)

Vulnerability from cvelistv5 – Published: 2024-06-20 11:13 – Updated: 2026-05-11 18:46
VLAI
Title
KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC The below warning is splatting during guest reboot. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm] CPU: 0 PID: 1931 Comm: qemu-system-x86 Tainted: G I 5.17.0-rc1+ #5 RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm] Call Trace: <TASK> kvm_vcpu_ioctl+0x279/0x710 [kvm] __x64_sys_ioctl+0x83/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd39797350b This can be triggered by not exposing tsc-deadline mode and doing a reboot in the guest. The lapic_shutdown() function which is called in sys_reboot path will not disarm the flying timer, it just masks LVTT. lapic_shutdown() clears APIC state w/ LVT_MASKED and timer-mode bit is 0, this can trigger timer-mode switch between tsc-deadline and oneshot/periodic, which can result in preemption timer be cancelled in apic_update_lvtt(). However, We can't depend on this when not exposing tsc-deadline mode and oneshot/periodic modes emulated by preemption timer. Qemu will synchronise states around reset, let's cancel preemption timer under KVM_SET_LAPIC.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:10 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8003c9ae204e21204e49816c5ea629357e283b06 , < 54b3439c8e70e0bcfea59aeef9dd98908cbbf655 (git)
Affected: 8003c9ae204e21204e49816c5ea629357e283b06 , < ce55f63f6cea4cab8ae9212f73285648a5baa30d (git)
Affected: 8003c9ae204e21204e49816c5ea629357e283b06 , < 35fe7cfbab2e81f1afb23fc4212210b1de6d9633 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 5.15.19 , ≤ 5.15.* (semver)
Unaffected: 5.16.5 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:00.534Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54b3439c8e70e0bcfea59aeef9dd98908cbbf655"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ce55f63f6cea4cab8ae9212f73285648a5baa30d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/35fe7cfbab2e81f1afb23fc4212210b1de6d9633"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:10:12.992201Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:47.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/lapic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "54b3439c8e70e0bcfea59aeef9dd98908cbbf655",
              "status": "affected",
              "version": "8003c9ae204e21204e49816c5ea629357e283b06",
              "versionType": "git"
            },
            {
              "lessThan": "ce55f63f6cea4cab8ae9212f73285648a5baa30d",
              "status": "affected",
              "version": "8003c9ae204e21204e49816c5ea629357e283b06",
              "versionType": "git"
            },
            {
              "lessThan": "35fe7cfbab2e81f1afb23fc4212210b1de6d9633",
              "status": "affected",
              "version": "8003c9ae204e21204e49816c5ea629357e283b06",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/lapic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.19",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.5",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: LAPIC: Also cancel preemption timer during SET_LAPIC\n\nThe below warning is splatting during guest reboot.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\n  CPU: 0 PID: 1931 Comm: qemu-system-x86 Tainted: G          I       5.17.0-rc1+ #5\n  RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_vcpu_ioctl+0x279/0x710 [kvm]\n   __x64_sys_ioctl+0x83/0xb0\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  RIP: 0033:0x7fd39797350b\n\nThis can be triggered by not exposing tsc-deadline mode and doing a reboot in\nthe guest. The lapic_shutdown() function which is called in sys_reboot path\nwill not disarm the flying timer, it just masks LVTT. lapic_shutdown() clears\nAPIC state w/ LVT_MASKED and timer-mode bit is 0, this can trigger timer-mode\nswitch between tsc-deadline and oneshot/periodic, which can result in preemption\ntimer be cancelled in apic_update_lvtt(). However, We can\u0027t depend on this when\nnot exposing tsc-deadline mode and oneshot/periodic modes emulated by preemption\ntimer. Qemu will synchronise states around reset, let\u0027s cancel preemption timer\nunder KVM_SET_LAPIC."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:46:30.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/54b3439c8e70e0bcfea59aeef9dd98908cbbf655"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce55f63f6cea4cab8ae9212f73285648a5baa30d"
        },
        {
          "url": "https://git.kernel.org/stable/c/35fe7cfbab2e81f1afb23fc4212210b1de6d9633"
        }
      ],
      "title": "KVM: LAPIC: Also cancel preemption timer during SET_LAPIC",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48765",
    "datePublished": "2024-06-20T11:13:41.830Z",
    "dateReserved": "2024-06-20T11:09:39.060Z",
    "dateUpdated": "2026-05-11T18:46:30.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48765",
      "date": "2026-09-17",
      "epss": "0.0021",
      "percentile": "0.11387"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48765\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-20T12:15:14.530\",\"lastModified\":\"2026-06-17T05:16:08.440\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: LAPIC: Also cancel preemption timer during SET_LAPIC\\n\\nThe below warning is splatting during guest reboot.\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\\n  CPU: 0 PID: 1931 Comm: qemu-system-x86 Tainted: G          I       5.17.0-rc1+ #5\\n  RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_vcpu_ioctl+0x279/0x710 [kvm]\\n   __x64_sys_ioctl+0x83/0xb0\\n   do_syscall_64+0x3b/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n  RIP: 0033:0x7fd39797350b\\n\\nThis can be triggered by not exposing tsc-deadline mode and doing a reboot in\\nthe guest. The lapic_shutdown() function which is called in sys_reboot path\\nwill not disarm the flying timer, it just masks LVTT. lapic_shutdown() clears\\nAPIC state w/ LVT_MASKED and timer-mode bit is 0, this can trigger timer-mode\\nswitch between tsc-deadline and oneshot/periodic, which can result in preemption\\ntimer be cancelled in apic_update_lvtt(). However, We can\u0027t depend on this when\\nnot exposing tsc-deadline mode and oneshot/periodic modes emulated by preemption\\ntimer. Qemu will synchronise states around reset, let\u0027s cancel preemption timer\\nunder KVM_SET_LAPIC.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: KVM: LAPIC: cancele tambi\u00e9n el temporizador de preferencia durante SET_LAPIC La siguiente advertencia aparece durante el reinicio del invitado. ------------[ cortar aqu\u00ed ]------------ ADVERTENCIA: CPU: 0 PID: 1931 en arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+ 0x874/0x880 [kvm] CPU: 0 PID: 1931 Comm: qemu-system-x86 Contaminado: GI 5.17.0-rc1+ #5 RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm] Seguimiento de llamadas:  79 /0x710 [kvm] __x64_sys_ioctl+0x83/0xb0 do_syscall_64+0x3b/0xc0 Entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd39797350b Esto se puede activar al no exponer el modo tsc-deadline y reiniciar el invitado. La funci\u00f3n lapic_shutdown() que se llama en la ruta sys_reboot no desarmar\u00e1 el temporizador de vuelo, simplemente enmascara el LVTT. lapic_shutdown() borra el estado de APIC con LVT_MASKED y el bit del modo de temporizador es 0, esto puede activar el cambio del modo de temporizador entre tsc-deadline y oneshot/peri\u00f3dico, lo que puede provocar que el temporizador de preferencia se cancele en apic_update_lvtt(). Sin embargo, no podemos depender de esto cuando no exponemos el modo tsc-deadline y los modos oneshot/peri\u00f3dico emulados por el temporizador de preferencia. Qemu sincronizar\u00e1 los estados alrededor del reinicio, cancelemos el temporizador de preferencia en KVM_SET_LAPIC.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/lapic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8003c9ae204e21204e49816c5ea629357e283b06\",\"lessThan\":\"54b3439c8e70e0bcfea59aeef9dd98908cbbf655\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8003c9ae204e21204e49816c5ea629357e283b06\",\"lessThan\":\"ce55f63f6cea4cab8ae9212f73285648a5baa30d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8003c9ae204e21204e49816c5ea629357e283b06\",\"lessThan\":\"35fe7cfbab2e81f1afb23fc4212210b1de6d9633\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/lapic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.19\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.5\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:10:12.992201Z\",\"id\":\"CVE-2022-48765\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.19\",\"matchCriteriaId\":\"352EAFB1-3E7D-4674-A4A1-B9D1E5BE738E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.5\",\"matchCriteriaId\":\"1AD9E77E-B27E-450C-8FD8-B64EC5FB002D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/35fe7cfbab2e81f1afb23fc4212210b1de6d9633\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/54b3439c8e70e0bcfea59aeef9dd98908cbbf655\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce55f63f6cea4cab8ae9212f73285648a5baa30d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/35fe7cfbab2e81f1afb23fc4212210b1de6d9633\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/54b3439c8e70e0bcfea59aeef9dd98908cbbf655\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce55f63f6cea4cab8ae9212f73285648a5baa30d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-02-02T10:49:59+00:00",
      "cve": "CVE-2022-48765",
      "id": "CVE-2022-48765",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "522",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "38",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48765.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/54b3439c8e70e0bcfea59aeef9dd98908cbbf655\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce55f63f6cea4cab8ae9212f73285648a5baa30d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/35fe7cfbab2e81f1afb23fc4212210b1de6d9633\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:00.534Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48765\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:10:12.992201Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.917Z\"}}], \"cna\": {\"title\": \"KVM: LAPIC: Also cancel preemption timer during SET_LAPIC\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8003c9ae204e21204e49816c5ea629357e283b06\", \"lessThan\": \"54b3439c8e70e0bcfea59aeef9dd98908cbbf655\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8003c9ae204e21204e49816c5ea629357e283b06\", \"lessThan\": \"ce55f63f6cea4cab8ae9212f73285648a5baa30d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8003c9ae204e21204e49816c5ea629357e283b06\", \"lessThan\": \"35fe7cfbab2e81f1afb23fc4212210b1de6d9633\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kvm/lapic.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/lapic.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/54b3439c8e70e0bcfea59aeef9dd98908cbbf655\"}, {\"url\": \"https://git.kernel.org/stable/c/ce55f63f6cea4cab8ae9212f73285648a5baa30d\"}, {\"url\": \"https://git.kernel.org/stable/c/35fe7cfbab2e81f1afb23fc4212210b1de6d9633\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: LAPIC: Also cancel preemption timer during SET_LAPIC\\n\\nThe below warning is splatting during guest reboot.\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\\n  CPU: 0 PID: 1931 Comm: qemu-system-x86 Tainted: G          I       5.17.0-rc1+ #5\\n  RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kvm_vcpu_ioctl+0x279/0x710 [kvm]\\n   __x64_sys_ioctl+0x83/0xb0\\n   do_syscall_64+0x3b/0xc0\\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\\n  RIP: 0033:0x7fd39797350b\\n\\nThis can be triggered by not exposing tsc-deadline mode and doing a reboot in\\nthe guest. The lapic_shutdown() function which is called in sys_reboot path\\nwill not disarm the flying timer, it just masks LVTT. lapic_shutdown() clears\\nAPIC state w/ LVT_MASKED and timer-mode bit is 0, this can trigger timer-mode\\nswitch between tsc-deadline and oneshot/periodic, which can result in preemption\\ntimer be cancelled in apic_update_lvtt(). However, We can\u0027t depend on this when\\nnot exposing tsc-deadline mode and oneshot/periodic modes emulated by preemption\\ntimer. Qemu will synchronise states around reset, let\u0027s cancel preemption timer\\nunder KVM_SET_LAPIC.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.19\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.5\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"4.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:46:30.146Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48765\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:46:30.146Z\", \"dateReserved\": \"2024-06-20T11:09:39.060Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-20T11:13:41.830Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.