CVE-2022-2196

Speculative execution attacks in KVM VMX

State: Published
Severity: 5.8 Medium
Published: Jan 9, 2023
Updated: Aug 7, 2026
Reserved: Jun 24, 2022

Description

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L	Google

Weaknesses

CWE-1188 Insecure Default Initialization of Resource

Affected Products

Product	Versions
Linux KernelLinux	64b8f33b2e1e687d465b5cb382e7bec495f1e026 to before f93a1a5bdcdd122aae0a3eab7a52c15b71fb725bAffected e089a83fbc55b8057f332c00f125acaa02b08ef7 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5Affected 02a3868d18fe639363f1cea6e6d7914513198e43 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5Affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 1b0cafaae8884726c597caded50af185ffc13349Affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 6b539a7dbb49250f92515c2ba60aea239efc9e35Affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 63fada296062e91ad9f871970d4e7f19e21a6a15Affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5Affected 5.4.47 to before 5.4.233Affected 5.6.19 to before 5.7.0Affected 5.7.3 to before 5.8.0Affected 5.8.0 to before 5.10.170Affected 5.11.0 to before 5.15.96Affected 5.16.0 to before 6.1.14Affected 6.2.0Not affected

Product

Versions

Linux KernelLinux

64b8f33b2e1e687d465b5cb382e7bec495f1e026 to before f93a1a5bdcdd122aae0a3eab7a52c15b71fb725bAffected
e089a83fbc55b8057f332c00f125acaa02b08ef7 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5Affected
02a3868d18fe639363f1cea6e6d7914513198e43 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5Affected
5c911beff20aa8639e7a1f28988736c13e03ed54 to before 1b0cafaae8884726c597caded50af185ffc13349Affected
5c911beff20aa8639e7a1f28988736c13e03ed54 to before 6b539a7dbb49250f92515c2ba60aea239efc9e35Affected
5c911beff20aa8639e7a1f28988736c13e03ed54 to before 63fada296062e91ad9f871970d4e7f19e21a6a15Affected
5c911beff20aa8639e7a1f28988736c13e03ed54 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5Affected
5.4.47 to before 5.4.233Affected
5.6.19 to before 5.7.0Affected
5.7.3 to before 5.8.0Affected
5.8.0 to before 5.10.170Affected
5.11.0 to before 5.15.96Affected
5.16.0 to before 6.1.14Affected
6.2.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.