medium 6.8

CVE-2022-1789 json

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva.

published 2022-05-31 4y ago modified 2026-06-17 4mo ago also EUVD-2022-25069

cvss: 6.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

Patch / fix

fixed in 1 distros 6

linux linux_kernel 5.8

debian ubuntu red hat suse almalinux arch linux

linux Debian 14, Debian 13, Debian 12 5.17.11-1

debian advisories DEBIAN-CVE-2022-1789

linux Ubuntu 20.04 LTS 5.4.0-122.138
linux Ubuntu 22.04 LTS 5.15.0-41.44
linux-aws Ubuntu 20.04 LTS 5.4.0-1081.88
linux-aws Ubuntu 22.04 LTS 5.15.0-1015.19
linux-gcp Ubuntu 20.04 LTS 5.4.0-1084.92
linux-gcp Ubuntu 22.04 LTS 5.15.0-1013.18
linux-gke Ubuntu 20.04 LTS 5.4.0-1078.84
linux-gke Ubuntu 22.04 LTS 5.15.0-1011.14

ubuntu advisories UBUNTU-CVE-2022-1789

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-284.11.1.el9_2
perf RHEL 9 5.14.0-284.11.1.el9_2
rtla RHEL 9 5.14.0-284.11.1.el9_2
bpftool RHEL 9 7.0.0-284.11.1.el9_2
kernel-64k RHEL 9 5.14.0-284.11.1.el9_2
kernel-core RHEL 9 5.14.0-284.11.1.el9_2
kernel-tools RHEL 9 5.14.0-284.11.1.el9_2
python3-perf RHEL 9 5.14.0-284.11.1.el9_2

red hat advisories RHSA-2024:4447 RHSA-2023:2458 RHSA-2023:2148 RHSA-2023:2736 RHSA-2023:2951

kernel-azure SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 5.14.21-150400.14.7.1
kernel-syms-azure SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 5.14.21-150400.14.7.1
kernel-source-azure SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 5.14.21-150400.14.7.1
dtb-aarch64 openSUSE Leap 15.4 5.14.21-150400.24.11.1
kernel-64kb SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 5.14.21-150400.24.11.1
kernel-syms SLE Module for Development Tools 15 SP4, openSUSE Leap 15.4 5.14.21-150400.24.11.1
kernel-obs-qa openSUSE Leap 15.4 5.14.21-150400.24.11.1
kernel-source SLE Module for Development Tools 15 SP4, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 5.14.21-150400.24.11.1

suse advisories SUSE-SU-2022:2615-1 SUSE-SU-2022:2520-1

kernel-rt AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-kvm AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-core AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-modules AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-debug-kvm AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-debug-core AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-debug-modules AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8
kernel-rt-modules-extra AlmaLinux 8 4.18.0-477.10.1.rt7.274.el8_8

almalinux advisories ALSA-2023:2736 ALSA-2023:2951 ALSA-2023:2148 ALSA-2023:2458

linux-lts Arch Linux 5.15.54-1
linux-hardened Arch Linux 5.18.11.hardened1-1
linux-zen Arch Linux 5.18.11.zen1-1
linux Arch Linux 5.18.11.arch1-1

arch linux advisories AVG-2772 AVG-2773 AVG-2774 AVG-2775

Is CVE-2022-1789 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1789 updated 2026-11-05 cvss 5.6

kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva

Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-284.11.1.el9_2, rtla 5.14.0-284.11.1.el9_2, kernel-devel-matched 5.14.0-284.11.1.el9_2, kernel-64k-devel-matched 5.14.0-284.11.1.el9_2, kernel-debug-devel-matched 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.11.1.el9_2, +5 more
fixed: vendor fix RHSA-2023:2458
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-477.10.1.el8_8, kernel 4.18.0-477.10.1.el8_8, bpftool 4.18.0-477.10.1.el8_8, kernel-core 4.18.0-477.10.1.el8_8, kernel-tools 4.18.0-477.10.1.el8_8, python3-perf 4.18.0-477.10.1.el8_8, +15 more
fixed: vendor fix RHSA-2023:2951
Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.0.0-284.11.1.el9_2, kernel 5.14.0-284.11.1.el9_2, kernel-64k 5.14.0-284.11.1.el9_2, kernel-core 5.14.0-284.11.1.el9_2, kernel-tools 5.14.0-284.11.1.el9_2, python3-perf 5.14.0-284.11.1.el9_2, +28 more
fixed: vendor fix RHSA-2023:2458
Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.111.1.el8_6, kernel 4.18.0-372.111.1.el8_6, bpftool 4.18.0-372.111.1.el8_6, kernel-core 4.18.0-372.111.1.el8_6, kernel-tools 4.18.0-372.111.1.el8_6, python3-perf 4.18.0-372.111.1.el8_6, +8 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) perf 4.18.0-372.111.1.el8_6, kernel 4.18.0-372.111.1.el8_6, bpftool 4.18.0-372.111.1.el8_6, kernel-core 4.18.0-372.111.1.el8_6, kernel-tools 4.18.0-372.111.1.el8_6, python3-perf 4.18.0-372.111.1.el8_6, +15 more Red Hat Enterprise Linux BaseOS TUS (v.8.6) perf 4.18.0-372.111.1.el8_6, kernel 4.18.0-372.111.1.el8_6, bpftool 4.18.0-372.111.1.el8_6, kernel-core 4.18.0-372.111.1.el8_6, kernel-tools 4.18.0-372.111.1.el8_6, python3-perf 4.18.0-372.111.1.el8_6, +8 more
fixed: vendor fix RHSA-2024:4447
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-477.10.1.el8_8, kernel-debuginfo-common-aarch64 4.18.0-477.10.1.el8_8, kernel-debuginfo-common-ppc64le 4.18.0-477.10.1.el8_8
fixed: vendor fix RHSA-2023:2951
Red Hat Enterprise Linux CRB (v. 9) kernel-debuginfo-common-s390x 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-x86_64 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-aarch64 5.14.0-284.11.1.el9_2, kernel-debuginfo-common-ppc64le 5.14.0-284.11.1.el9_2
fixed: vendor fix RHSA-2023:2458
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-kvm 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-core 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-modules 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-kvm 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-core 4.18.0-477.10.1.rt7.274.el8_8, +4 more
fixed: vendor fix RHSA-2023:2736
Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-kvm 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-modules 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-kvm 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-core 5.14.0-284.11.1.rt14.296.el9_2, +6 more
fixed: vendor fix RHSA-2023:2148

show 3 more

Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-core 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-modules 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-core 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-debug-modules 4.18.0-477.10.1.rt7.274.el8_8, kernel-rt-modules-extra 4.18.0-477.10.1.rt7.274.el8_8, +2 more
fixed: vendor fix RHSA-2023:2736
Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-modules 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-modules-core 5.14.0-284.11.1.rt14.296.el9_2, kernel-rt-debug-modules 5.14.0-284.11.1.rt14.296.el9_2, +4 more
fixed: vendor fix RHSA-2023:2148
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.8	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

n/a kernel

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IBUOQTNTQ4ZCXHOCNKYIL2ZUIAZ675RD/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/KCEAPIVPRTJHKPF2A2HVF5XHD5XJT3MN/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/H6JP355XFVAB33X4BNO3ERVTURFYEDB7/
vendor-advisory
debian.org /security/2022/dsa-5161
vendor-advisory, third-party-advisory
francozappa.github.io /about-bias/
not-applicable
bugzilla.redhat.com /show_bug.cgi?id=1832397
not-applicable
kb.cert.org /vuls/id/647177/
not-applicable

Sources

CVE List CVE-2022-1789
NVD CVE-2022-1789

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed