CVE-2022-1789

What it actually does

NULL pointer dereference in kvm_mmu_invpcid_gva when INVPCID executes with CR0.PG=0 under shadow paging, because the invlpg callback is unset.

Why it matters to the business

Guest-triggered host kernel crashes can cause denial of service for virtualized workloads, unplanned downtime, and potential loss of availability in cloud or hypervisor environments; low exploitability limits widespread impact but requires urgent patching on exposed systems.

How an attack unfolds

An attacker with the ability to execute code inside a guest VM configures shadow paging, clears the paging bit in CR0, then issues an INVPCID instruction; the resulting call path reaches kvm_mmu_invpcid_gva with a NULL invlpg callback and dereferences it, crashing the host kernel.

How to fix it

Upgrade the Linux kernel to the commit bcf876870b95592b52519ed4aafcf9d95999bc9c or later; rebuild and deploy the fixed kernel on all affected hosts; test the patch in a staging environment before production rollout.

How to confirm the fix worked

Verify the running kernel contains commit bcf876870b95592b52519ed4aafcf9d95999bc9c; attempt to reproduce the INVPCID sequence in a test guest with shadow paging and confirm absence of NULL dereference oops; review kernel build logs for the patched function.

Typical attack path

1. Obtain code execution inside a KVM guest VM
2. Enable shadow paging mode in the guest
3. Clear CR0.PG to disable paging
4. Execute the INVPCID instruction
5. Trigger NULL pointer dereference in host KVM MMU code

How to detect it

Search host kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference oops or panic entries referencing kvm_mmu_invpcid_gva or invlpg callback; correlate with guest activity that manipulates CR0 or issues INVPCID.

• kvm_mmu_invpcid_gva
• invlpg callback
• NULL pointer dereference
• CR0.PG

What your security team should do

• Apply the referenced kernel commit immediately on all hypervisor hosts
• Prioritize systems running KVM with shadow paging enabled
• Monitor for kernel oops messages containing kvm_mmu_invpcid_gva
• Disable shadow paging where feasible until patched