Review reviewHigh

CVE-2022-49883

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86_FEATURE_LM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host, the rsm_load_state_64/enter_smm_save_state_64 is compiled out, thus access overflow can't happen.

CVSS: 7.1
EPSS: 0.17%
CISA KEV: Not listed
Published: 2025.05.02

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.17%

Technical severityCVSS 7.1

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= b443183a25ab61840a12de92f8822849e017b9c8 < a7ebfbea0f52550d7cdf12c38f3f5eaa7b2b6494, >= b443183a25ab61840a12de92f8822849e017b9c8 < 696db303e54f7352623d9f640e6c51d8fa9d5588, >= 6.0, >= 6.0 < 6.0.8, 6.1
Fixed versions: 6.0.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE: CWE-125