{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-49882",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-49882",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2025-05-01T14:10:29.213Z",
    "updatedAt": "2026-10-15T21:21:08.416Z",
    "importedAt": "2026-10-24T01:56:49.724Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache\n\nReject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive.\nNot checking the active flag during refresh is particularly egregious, as\nKVM can end up with a valid, inactive cache, which can lead to a variety\nof use-after-free bugs, e.g. consuming a NULL kernel pointer or missing\nan mmu_notifier invalidation due to the cache not being on the list of\ngfns to invalidate.\n\nNote, \"active\" needs to be set if and only if the cache is on the list\nof caches, i.e. is reachable via mmu_notifier events.  If a relevant\nmmu_notifier event occurs while the cache is \"active\" but not on the\nlist, KVM will not acquire the cache's lock and so will not serailize\nthe mmu_notifier event with active users and/or kvm_gpc_refresh().\n\nA race between KVM_XEN_ATTR_TYPE_SHARED_INFO and KVM_XEN_HVM_EVTCHN_SEND\ncan be exploited to trigger the bug.\n\n1. Deactivate shinfo cache:\n\nkvm_xen_hvm_set_attr\ncase KVM_XEN_ATTR_TYPE_SHARED_INFO\n kvm_gpc_deactivate\n  kvm_gpc_unmap\n   gpc->valid = false\n   gpc->khva = NULL\n  gpc->active = false\n\nResult: active = false, valid = false\n\n2. Cause cache refresh:\n\nkvm_arch_vm_ioctl\ncase KVM_XEN_HVM_EVTCHN_SEND\n kvm_xen_hvm_evtchn_send\n  kvm_xen_set_evtchn\n   kvm_xen_set_evtchn_fast\n    kvm_gpc_check\n    return -EWOULDBLOCK because !gpc->valid\n   kvm_xen_set_evtchn_fast\n    return -EWOULDBLOCK\n   kvm_gpc_refresh\n    hva_to_pfn_retry\n     gpc->valid = true\n     gpc->khva = not NULL\n\nResult: active = false, valid = true\n\n3. Race ioctl KVM_XEN_HVM_EVTCHN_SEND against ioctl\nKVM_XEN_ATTR_TYPE_SHARED_INFO:\n\nkvm_arch_vm_ioctl\ncase KVM_XEN_HVM_EVTCHN_SEND\n kvm_xen_hvm_evtchn_send\n  kvm_xen_set_evtchn\n   kvm_xen_set_evtchn_fast\n    read_lock gpc->lock\n                                          kvm_xen_hvm_set_attr case\n                                          KVM_XEN_ATTR_TYPE_SHARED_INFO\n                                           mutex_lock kvm->lock\n                                           kvm_xen_shared_info_init\n                                            kvm_gpc_activate\n                                             gpc->khva = NULL\n    kvm_gpc_check\n     [ Check passes because gpc->valid is\n       still true, even though gpc->khva\n       is already NULL. ]\n    shinfo = gpc->khva\n    pending_bits = shinfo->evtchn_pending\n    CRASH: test_and_set_bit(..., pending_bits)",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "982ed0de4753ed6e71dbd40f82a5a066baf133ed",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bfa9672f8fc9eb118124bab61899d2dd497f95ba"
            },
            {
              "version": "982ed0de4753ed6e71dbd40f82a5a066baf133ed",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ecbcf030b45666ad11bc98565e71dfbcb7be4393"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.17",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.17"
            },
            {
              "version": "6.0.8",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "version": "6.1",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}