CVE-2022-1852

What it actually does

NULL pointer dereference in KVM x86 instruction emulator (arch/x86/kvm/emulate.c:x86_emulate_insn) when a guest executes an illegal instruction on Intel CPUs, resulting in host kernel crash or denial of service.

Why it matters to the business

Virtual machine guests can crash the host system, causing widespread downtime for any services or workloads running on affected Linux hosts that use KVM virtualization.

How an attack unfolds

An attacker with guest VM access crafts and executes an illegal instruction on an Intel CPU; the KVM emulator path in x86_emulate_insn encounters an unhandled condition that dereferences a NULL pointer, triggering a kernel panic on the host.

How to fix it

Update the Linux kernel to include commit fee060cd52d69c114b62d1a2948ea9648b5131f9 or apply the equivalent vendor backport that resolves the NULL dereference in the KVM emulator; reboot hosts after patching.

How to confirm the fix worked

Confirm the presence of commit fee060cd52d69c114b62d1a2948ea9648b5131f9 in the kernel source tree, verify the running kernel version contains the fix, or test that an illegal instruction in a guest no longer causes host panic.

Typical attack path

1. Gain access to a guest virtual machine on an affected Linux KVM host
2. Execute an illegal instruction from within the guest context on Intel hardware
3. Trigger the NULL pointer dereference inside the KVM emulator
4. Cause host kernel crash and denial of service to all VMs on the host

How to detect it

Search host kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing x86_emulate_insn or NULL pointer dereference originating from the KVM module; correlate with guest activity timestamps.

• x86_emulate_insn
• NULL pointer dereference.*kvm
• arch/x86/kvm/emulate.c

What your security team should do

• Prioritize kernel updates on all KVM hosts within the next maintenance window
• Isolate or restrict untrusted guest workloads until patches are applied
• Review virtualization platform monitoring for guest-induced host instability
• Subscribe to kernel security mailing lists for future KVM-related advisories