Host crash via premature KVM device exposure
Published May 2, 2025 · Updated May 23, 2026
A KVM VMX initialization race in the Linux kernel allows local users to crash the host by creating a vCPU during module setup. vmx_init exposes /dev/kvm through kvm_init before configuring the per-CPU loaded_vmcss_on_cpu list, so an early KVM_CREATE_VCPU operation writes through an uninitialized list pointer. Exploitation requires access to /dev/kvm during the narrow kvm_intel initialization window, and the documented consequence is a kernel NULL-pointer dereference and host interruption.
Summary
What happened
A KVM VMX initialization race in the Linux kernel allows local users to crash the host by creating a vCPU during module setup. vmx_init exposes /dev/kvm through kvm_init before configuring the per-CPU loaded_vmcss_on_cpu list, so an early KVM_CREATE_VCPU operation writes through an uninitialized list pointer. Exploitation requires access to /dev/kvm during the narrow kvm_intel initialization window, and the documented consequence is a kernel NULL-pointer dereference and host interruption.
The record
- CVE
- CVE-2022-49932
- Published
- May 2, 2025
- Updated
- May 23, 2026
- Vendor
- The Linux Kernel Organization
- Product
- Linux
- Classifications
- CWE-476, T1499
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- May 2, 2025CVE publishedPublication date reported by the CVE source.
- May 23, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=2c0bf2560ca18abe1451db23b8ef8700c67cc44f
- Affected versionversion=40888c31aca3a46f266f1f121679f8e1982df085
- Affected versionversion=4.14.177 <4.15
- Affected versionversion=4.19.116 <4.20
- Affected versionversion=4.9.220 <4.10
- Affected versionversion=5.4.33 <5.5
- Affected versionversion=5.5.18 <5.6
- Affected versionversion=5.6.5 <5.7
- Affected versionversion=5.7
- Affected versionversion=b2f7d0adc1260fa33ff3e992d18ff15873e68a67
- Affected versionversion=cd3f438fbb9cb60da32dd2b665f7dc9baba1c4ad
- Affected versionversion=dbef2808af6c594922fe32833b30f55f35e9da6d <e136e969d268b9b89329c816c002e53f60e82985
- Affected versionversion=dbef2808af6c594922fe32833b30f55f35e9da6d <e28533c08023c4b319b7f2cd77f3f7c9204eb517
- Affected versionversion=dbef2808af6c594922fe32833b30f55f35e9da6d <e32b120071ea114efc0b4ddd439547750b85f618
- Affected versionversion=e35a2dc8c7f664ae8a9cc46d19985dc79bfc1083
- Affected versionversion=f9971a898a815c2a6cce2932e91a576b28ed4cce
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo