medium 5.5

CVE-2022-1263 json

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled.

published 2022-08-31 4y ago modified 2026-06-17 4mo ago also EUVD-2022-24596

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.

Patch / fix

fixed in 1 distros 5 links 2

linux linux_kernel 5.18

debian ubuntu red hat suse azure linux

linux Debian 14, Debian 13, Debian 12 5.17.3-1

debian advisories DEBIAN-CVE-2022-1263

linux Ubuntu 22.04 LTS 5.15.0-37.39
linux-aws Ubuntu 22.04 LTS 5.15.0-1011.14
linux-gcp Ubuntu 22.04 LTS 5.15.0-1008.12
linux-gke Ubuntu 22.04 LTS 5.15.0-1008.10
linux-ibm Ubuntu 22.04 LTS 5.15.0-1007.8
linux-kvm Ubuntu 22.04 LTS 5.15.0-1010.11
linux-azure Ubuntu 22.04 LTS 5.15.0-1010.12
linux-raspi Ubuntu 22.04 LTS 5.15.0-1011.13

ubuntu advisories UBUNTU-CVE-2022-1263

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-162.6.1.el9_1
perf RHEL 9 5.14.0-162.6.1.el9_1
bpftool RHEL 9 5.14.0-162.6.1.el9_1
kernel-core RHEL 9 5.14.0-162.6.1.el9_1
kernel-tools RHEL 9 5.14.0-162.6.1.el9_1
python3-perf RHEL 9 5.14.0-162.6.1.el9_1
kernel-modules RHEL 9 5.14.0-162.6.1.el9_1
kernel-zfcpdump RHEL 9 5.14.0-162.6.1.el9_1

red hat advisories RHSA-2022:8267 RHSA-2022:7933 RHSA-2022:7683 RHSA-2022:7444

kernel-rt Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-syms-rt Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-rt_debug Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
kernel-source-rt Real Time Module 15 SP4, openSUSE Leap 15.4 5.14.21-150400.15.5.1
dtb-aarch64 openSUSE Leap 15.4 5.14.21-150400.24.28.1
kernel-64kb SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 5.14.21-150400.24.28.1
kernel-syms SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 5.14.21-150400.24.28.1
kernel-obs-qa openSUSE Leap 15.4 5.14.21-150400.24.28.1

suse advisories SUSE-SU-2022:4617-1 SUSE-SU-2022:3844-1 SUSE-SU-2022:3585-1

kernel CBL-Mariner 2.0 5.15.67.1-4

azure linux advisories AZL-10820

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/torvalds/linux@5593473 commit
bugzilla.redhat.com/show_bug.cgi?id=2072698 advisory

Is CVE-2022-1263 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1263 updated 2026-11-05 cvss 5.5

kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c

Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-425.3.1.el8, kernel-debuginfo-common-aarch64 4.18.0-425.3.1.el8, kernel-debuginfo-common-ppc64le 4.18.0-425.3.1.el8
fixed: vendor fix RHSA-2022:7683
Red Hat CodeReady Linux Builder (v. 9) kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-aarch64 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-ppc64le 5.14.0-162.6.1.el9_1 Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-162.6.1.el9_1, kernel-devel-matched 5.14.0-162.6.1.el9_1, kernel-debug-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-s390x 5.14.0-162.6.1.el9_1, kernel-zfcpdump-devel-matched 5.14.0-162.6.1.el9_1, kernel-debuginfo-common-x86_64 5.14.0-162.6.1.el9_1, +2 more
fixed: vendor fix RHSA-2022:8267
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-425.3.1.el8, kernel 4.18.0-425.3.1.el8, bpftool 4.18.0-425.3.1.el8, kernel-core 4.18.0-425.3.1.el8, kernel-tools 4.18.0-425.3.1.el8, python3-perf 4.18.0-425.3.1.el8, +15 more
fixed: vendor fix RHSA-2022:7683
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-162.6.1.el9_1, bpftool 5.14.0-162.6.1.el9_1, kernel-core 5.14.0-162.6.1.el9_1, kernel-tools 5.14.0-162.6.1.el9_1, python3-perf 5.14.0-162.6.1.el9_1, kernel-modules 5.14.0-162.6.1.el9_1, +14 more
fixed: vendor fix RHSA-2022:8267
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-425.3.1.rt7.213.el8, kernel-rt-core 4.18.0-425.3.1.rt7.213.el8, kernel-rt-modules 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-core 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-modules 4.18.0-425.3.1.rt7.213.el8, kernel-rt-modules-extra 4.18.0-425.3.1.rt7.213.el8, +2 more
fixed: vendor fix RHSA-2022:7444
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-core 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-modules 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-core 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-modules 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-modules-extra 5.14.0-162.6.1.rt21.168.el9_1, +2 more
fixed: vendor fix RHSA-2022:7933
Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-425.3.1.rt7.213.el8, kernel-rt-kvm 4.18.0-425.3.1.rt7.213.el8, kernel-rt-core 4.18.0-425.3.1.rt7.213.el8, kernel-rt-modules 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-kvm 4.18.0-425.3.1.rt7.213.el8, kernel-rt-debug-core 4.18.0-425.3.1.rt7.213.el8, +4 more
fixed: vendor fix RHSA-2022:7444
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-kvm 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-core 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-modules 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-kvm 5.14.0-162.6.1.rt21.168.el9_1, kernel-rt-debug-core 5.14.0-162.6.1.rt21.168.el9_1, +4 more
fixed: vendor fix RHSA-2022:7933

show 1 more

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

openwall.com https://www.openwall.com/lists/oss-security/2022/04/07/1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

n/a Kernel:KVM

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

github.com /torvalds/linux/commit/5593473a1e6c743764b08e3b6071cb43b5cfa6c4
patch, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=2072698
issue-tracking, patch, third-party-advisory
openwall.com /lists/oss-security/2022/04/07/1
exploit, mailing-list, third-party-advisory
access.redhat.com /security/cve/CVE-2022-1263
third-party-advisory

Sources

CVE List CVE-2022-1263
NVD CVE-2022-1263

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed