CVE-2022-48943: KVM: x86/mmu: make apf token non-zero to fix bug
Vulnerability summary
CVE-2022-48943 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.1% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 23 · Related 19Timeline
- 22-08-2024PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu100 products
- linux< 4.4.0-261.295 | < 4.15.0-231.243 | < 5.4.0-202.222 | < 3.13.0-200.251
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1138.144 | < 4.4.0-1176.191 | < 4.15.0-1175.188 | < 5.4.0-1136.146
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b, < 72fdfc75d4217b32363cc80def3de2cb3fef3f02 | ≥ 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b, < 4c3644b6c96c5daa5149e5abddc07234eea47c7c | ≥ 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b, < 62040f5cd7d937de547836e747b6aa8212fec573 | ≥ 2635b5c4a0e407b84f68e188c719f28ba0e9ae1b, < 6f3c1fc53d86d580d8d6d749c4af23705e4f6f79 | 5.8
- linux_kernel< 5.10.103 | ≥ 5.11, < 5.15.26 | ≥ 5.16, < 5.16.12
Debian1 product
- linux< 5.16.12-1
3 vendors · 103 products
