CVE-2022-48727

What it actually does

Race condition in KVM arm64 exception handling allows stale ESR_EL2 value from prior HVC to be used when an IRQ synchronizes a pending SError, resulting in incorrect decrement of ELR_EL2 and double execution of an unrelated guest instruction.

Why it matters to the business

Virtual machines running on affected ARM64 Linux hosts may experience unpredictable guest behavior or crashes, increasing operational risk for cloud and virtualization workloads until kernels are updated.

How an attack unfolds

An attacker with the ability to trigger IRQs concurrent with SError delivery during HVC handling in a guest can cause KVM to rewind the wrong instruction pointer, leading to repeated execution of guest code and potential control-flow or data corruption within the guest.

How to fix it

Upgrade the Linux kernel to a version containing commit e1e852746997500f1873f60b954da5f02cc2dba3 or later; rebuild and reboot affected arm64 hosts.

How to confirm the fix worked

Confirm the running kernel contains commit e1e852746997500f1873f60b954da5f02cc2dba3 via git log or uname output; review KVM exit handling code for the ARM_EXCEPTION_CODE() check before ELR_EL2 modification.

Typical attack path

1. Trigger a non-IRQ exception such as HVC from the guest
2. Arrange for an IRQ to occur while an SError becomes pending and is synchronized by KVM
3. KVM incorrectly consults the stale ESR value and rewinds ELR_EL2
4. Guest resumes execution of an unrelated instruction a second time

How to detect it

Review kernel logs and KVM tracepoints for repeated guest instruction execution patterns or unexpected ELR_EL2 adjustments around IRQ and SError events; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all arm64 KVM hosts within standard change windows
• Monitor upstream stable branches for backports of the referenced commit
• Test guest workloads that heavily use HVC or virtualization exceptions after patching