CVE-2022-48765

What it actually does

Failure to cancel the LAPIC preemption timer during KVM_SET_LAPIC when tsc-deadline mode is not exposed allows a timer-mode switch to leave an active timer, triggering a warning in kvm_arch_vcpu_ioctl_run during guest reboot paths that call lapic_shutdown.

Why it matters to the business

Kernel warnings and potential guest instability during VM reboots increase operational overhead for virtualization hosts and may disrupt workloads that rely on frequent guest restarts; the issue affects widely used Linux kernel versions in cloud and enterprise environments.

How an attack unfolds

An attacker with the ability to trigger a guest reboot (via compromised guest or management interface) can cause the kernel to hit the warning path when the preemption timer remains armed after LAPIC state is masked without tsc-deadline support; the race between timer mode emulation and state synchronization during reset leads to the splat.

How to fix it

Update the Linux kernel to a version containing commit 54b3439c8e70e0bcfea59aeef9dd98908cbbf655 or later; apply the stable patch that adds explicit preemption timer cancellation inside KVM_SET_LAPIC.

How to confirm the fix worked

Confirm the running kernel contains commit 54b3439c8e70e0bcfea59aeef9dd98908cbbf655; reproduce a guest reboot without tsc-deadline exposure and verify absence of the kvm_arch_vcpu_ioctl_run warning; inspect KVM LAPIC timer handling code for the added cancel call.

Typical attack path

1. Obtain ability to control or reboot a KVM guest
2. Ensure guest does not expose tsc-deadline LAPIC mode
3. Trigger sys_reboot inside the guest
4. lapic_shutdown masks LVTT without disarming the flying preemption timer
5. KVM_SET_LAPIC synchronizes state without canceling the timer
6. apic_update_lvtt timer-mode switch leaves the timer active
7. Warning fires in kvm_arch_vcpu_ioctl_run

How to detect it

Search kernel logs and dmesg for the string "WARNING: CPU.*kvm_arch_vcpu_ioctl_run" combined with guest reboot activity; correlate with KVM vCPU ioctl traces showing LAPIC state changes without tsc-deadline mode.

• WARNING: CPU:.*kvm_arch_vcpu_ioctl_run.*kvm
• lapic_shutdown.*LVT_MASKED
• apic_update_lvtt.*preemption timer

What your security team should do

• Prioritize kernel updates on all KVM hosts within normal change windows
• Monitor for the specific warning string in dmesg or kernel logs on virtualization servers
• Test the fixed kernel in staging environments that exercise frequent guest reboots
• Review any downstream distributions for backported fixes matching the referenced commit