---
id: CVE-2022-50224
title: 'KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT

  Treat the NX bit as valid when using NPT, as KVM will set the NX bit when
  the NX huge page mitigation is enabled (mi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 <
    6271f2854b9233702e236e576b885a876dde4889
  - >-
    Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 <
    6c6ab524cfae0799e55c82b2c1d61f1af0156f8d
  - Linux a7ad7943b84fae87f5be18f05025c51ae103f732
  - Linux bb16a6ba5d1ed79b40caea8d924e237f63205b7c
  - Linux 5219505fcbb640e273a0d51c19c38de0100ec5a9
  - Linux 78ffa84f00ff6b19f00c0e6dfe1870aba0db4025
  - Linux >= 4.9.202 < 4.10
  - Linux >= 4.14.154 < 4.15
  - Linux >= 4.19.84 < 4.20
  - Linux >= 5.3.11 < 5.4
  - Linux 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:07:13.568763Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:29.672Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50224'
references:
  - url: 'https://git.kernel.org/stable/c/6271f2854b9233702e236e576b885a876dde4889'
  - url: 'https://git.kernel.org/stable/c/6c6ab524cfae0799e55c82b2c1d61f1af0156f8d'
tags:
  - cve.org
epss: 0.002
epssPercentile: 0.09901
ingestedAt: '2026-11-05T22:38:31.708Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT

Treat the NX bit as valid when using NPT, as KVM will set the NX bit when
the NX huge page mitigation is enabled (mindblowing) and trigger the WARN
that fires on reserved SPTE bits being set.

KVM has required NX support for SVM since commit b26a71a1a5b9 ("KVM: SVM:
Refuse to load kvm_amd if NX support is not available") for exactly this
reason, but apparently it never occurred to anyone to actually test NPT
with the mitigation enabled.

  ------------[ cut here ]------------
  spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000
  WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm]
  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022
  RIP: 0010:make_spte+0x327/0x340 [kvm]
  Call Trace:
   <TASK>
   tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm]
   kvm_tdp_mmu_map+0x343/0x3b0 [kvm]
   direct_page_fault+0x1ae/0x2a0 [kvm]
   kvm_tdp_page_fault+0x7d/0x90 [kvm]
   kvm_mmu_page_fault+0xfb/0x2e0 [kvm]
   npf_interception+0x55/0x90 [kvm_amd]
   svm_invoke_exit_handler+0x31/0xf0 [kvm_amd]
   svm_handle_exit+0xf6/0x1d0 [kvm_amd]
   vcpu_enter_guest+0xb6d/0xee0 [kvm]
   ? kvm_pmu_trigger_event+0x6d/0x230 [kvm]
   vcpu_run+0x65/0x2c0 [kvm]
   kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm]
   kvm_vcpu_ioctl+0x551/0x610 [kvm]
   __se_sys_ioctl+0x77/0xc0
   __x64_sys_ioctl+0x1d/0x20
   do_syscall_64+0x44/0xa0
   entry_SYSCALL_64_after_hwframe+0x46/0xb0
   </TASK>
  ---[ end trace 0000000000000000 ]---

## Affected

- `Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 < 6271f2854b9233702e236e576b885a876dde4889`
- `Linux >= b8e8c8303ff28c61046a4d0f6ea99aea609a7dc0 < 6c6ab524cfae0799e55c82b2c1d61f1af0156f8d`
- `Linux a7ad7943b84fae87f5be18f05025c51ae103f732`
- `Linux bb16a6ba5d1ed79b40caea8d924e237f63205b7c`
- `Linux 5219505fcbb640e273a0d51c19c38de0100ec5a9`
- `Linux 78ffa84f00ff6b19f00c0e6dfe1870aba0db4025`
- `Linux >= 4.9.202 < 4.10`
- `Linux >= 4.14.154 < 4.15`
- `Linux >= 4.19.84 < 4.20`
- `Linux >= 5.3.11 < 5.4`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.