Riskcovery

CVE-2022-49610

KVM: VMX: Prevent RSB underflow before vmenter

State
Published
Severity
Not scored
Published
Feb 26, 2025
Updated
May 23, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Prevent RSB underflow before vmenter

On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.

Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.

For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.

[ bp: Fix 32-bit build. ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d28b387fb74da95d69d2615732f50cceb38e9a4d to before afd743f6dde87296c6f3414706964c491bb85862Affected
  • d28b387fb74da95d69d2615732f50cceb38e9a4d to before 07853adc29a058c5fd143c14e5ac528448a72ed9Affected
  • 44491a23b73789c0a914af4ea55ccf8968adf90bAffected
  • fc6aae9f407810cb153a9133c28735871f9f0a16Affected
  • 3.16.57 to before 3.17Affected
  • 4.4.168 to before 4.5Affected
LinuxLinux
  • 4.16Affected
  • before 4.16Not affected
  • 5.18.14 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.