{"id":"CVE-2022-50224","title":"KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Treat NX as a valid SPTE bit for NPT\n\nTreat the NX bit as valid when using NPT, as KVM will set the NX bit when\nthe NX huge page mitigation is enabled (mi…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 < 6271f2854b9233702e236e576b885a876dde4889","Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 < 6c6ab524cfae0799e55c82b2c1d61f1af0156f8d","Linux a7ad7943b84fae87f5be18f05025c51ae103f732","Linux bb16a6ba5d1ed79b40caea8d924e237f63205b7c","Linux 5219505fcbb640e273a0d51c19c38de0100ec5a9","Linux 78ffa84f00ff6b19f00c0e6dfe1870aba0db4025","Linux >= 4.9.202 < 4.10","Linux >= 4.14.154 < 4.15","Linux >= 4.19.84 < 4.20","Linux >= 5.3.11 < 5.4","Linux 5.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:07:13.568763Z"},"published":"2025-06-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:10:29.672Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50224","references":[{"url":"https://git.kernel.org/stable/c/6271f2854b9233702e236e576b885a876dde4889"},{"url":"https://git.kernel.org/stable/c/6c6ab524cfae0799e55c82b2c1d61f1af0156f8d"}],"tags":["cve.org"],"epss":0.002,"epssPercentile":0.09901,"ingestedAt":"2026-11-05T22:38:31.708Z","slug":"CVE-2022-50224","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Treat NX as a valid SPTE bit for NPT\n\nTreat the NX bit as valid when using NPT, as KVM will set the NX bit when\nthe NX huge page mitigation is enabled (mindblowing) and trigger the WARN\nthat fires on reserved SPTE bits being set.\n\nKVM has required NX support for SVM since commit b26a71a1a5b9 (\"KVM: SVM:\nRefuse to load kvm_amd if NX support is not available\") for exactly this\nreason, but apparently it never occurred to anyone to actually test NPT\nwith the mitigation enabled.\n\n  ------------[ cut here ]------------\n  spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000\n  WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm]\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022\n  RIP: 0010:make_spte+0x327/0x340 [kvm]\n  Call Trace:\n   <TASK>\n   tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm]\n   kvm_tdp_mmu_map+0x343/0x3b0 [kvm]\n   direct_page_fault+0x1ae/0x2a0 [kvm]\n   kvm_tdp_page_fault+0x7d/0x90 [kvm]\n   kvm_mmu_page_fault+0xfb/0x2e0 [kvm]\n   npf_interception+0x55/0x90 [kvm_amd]\n   svm_invoke_exit_handler+0x31/0xf0 [kvm_amd]\n   svm_handle_exit+0xf6/0x1d0 [kvm_amd]\n   vcpu_enter_guest+0xb6d/0xee0 [kvm]\n   ? kvm_pmu_trigger_event+0x6d/0x230 [kvm]\n   vcpu_run+0x65/0x2c0 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm]\n   kvm_vcpu_ioctl+0x551/0x610 [kvm]\n   __se_sys_ioctl+0x77/0xc0\n   __x64_sys_ioctl+0x1d/0x20\n   do_syscall_64+0x44/0xa0\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n   </TASK>\n  ---[ end trace 0000000000000000 ]---\n\n## Affected\n\n- `Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 < 6271f2854b9233702e236e576b885a876dde4889`\n- `Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 < 6c6ab524cfae0799e55c82b2c1d61f1af0156f8d`\n- `Linux a7ad7943b84fae87f5be18f05025c51ae103f732`\n- `Linux bb16a6ba5d1ed79b40caea8d924e237f63205b7c`\n- `Linux 5219505fcbb640e273a0d51c19c38de0100ec5a9`\n- `Linux 78ffa84f00ff6b19f00c0e6dfe1870aba0db4025`\n- `Linux >= 4.9.202 < 4.10`\n- `Linux >= 4.14.154 < 4.15`\n- `Linux >= 4.19.84 < 4.20`\n- `Linux >= 5.3.11 < 5.4`\n- `Linux 5.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}