CVE-2022-2196 - CVE House

Back to Database

Status published Medium CVE-2022-2196

Speculative execution attacks in KVM VMX

5.8 CVSS

Vulnerability Description

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2196

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Linux

View All →

drm/vkms: Convert to DRM's vblank timer

drm/panthor: Recover from panthor_gpu_flush_caches() failures

PCI: endpoint: Add missing NULL check for alloc_workqueue()

fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()

fs/ntfs3: Initialize new folios before use

Affected Vendor

Linux

View all reports →

Affected Software

Linux Kernel

Vulnerable Versions:

0

Timeline

Official Publish: January 9th, 2023

Last Modified: February 13th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.