CVE-2022-45869

What it actually does

Race condition in x86 KVM subsystem with nested virtualization and TDP MMU enabled allows guest users to trigger host OS crash or memory corruption.

Why it matters to the business

Disrupts virtualized Linux hosts by causing crashes that halt all guest workloads, leading to unplanned downtime and potential data loss in environments relying on KVM for isolation.

How an attack unfolds

An attacker with access to a guest VM under nested virtualization and TDP MMU conditions triggers the race condition through specific memory management operations to induce host instability.

How to fix it

Update the Linux kernel to the fixed commit 47b0c2e4c220f2251fd8dcfbb44479819c715e15 or later versions containing this patch. Disable nested virtualization if not required for operations.

How to confirm the fix worked

Verify the running kernel includes commit 47b0c2e4c220f2251fd8dcfbb44479819c715e15 via git log or uname output, and test nested VM workloads under TDP MMU to confirm stability.

Typical attack path

1. Obtain local access within a guest VM
2. Ensure nested virtualization and TDP MMU are enabled on the host
3. Execute operations that race KVM MMU code paths
4. Trigger host OS crash or corruption

How to detect it

Review kernel logs for KVM-related oops, panics, or memory corruption messages on hosts with nested virtualization; correlate with guest activity spikes and unexpected host reboots.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected hosts
• Audit virtualization configurations to disable nested features where unnecessary
• Monitor for kernel oops or panics in KVM subsystems
• Review EPSS and exploit availability trends for increased scrutiny