Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U N N H 4.7 .0012 2.1 —
AFFECTED Product Versions Fixed Linux 982ed0de4753ed6e71dbd40f82a5a066baf133ed – — Linux 5.17 – 6.0.8
TIMELINE May 1 Reserved by Linux May 1 Published (CNA: Linux) Aug 4 RESCORED — CVE-2022-49884 (Linux). CVSS 7.8 → 4.7 (NVD).
In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfn_to_pfn_cache locks in dedicated helper Move the gfn_to_pfn_cache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvm_gfn_to_pfn_cache_init()'s ability to re-initialize the cache's locks. For example: a race between ioctl(KVM_XEN_HVM_EVTCHN_SEND) and kvm_gfn_to_pfn_cache_init() leads to a corrupted shinfo gpc lock. (thread 1) | (thread 2) | kvm_xen_set_evtchn_fast | read_lock_irqsave(&gpc->lock, ...) | | kvm_gfn_to_pfn_cache_init | rwlock_init(&gpc->lock) read_unlock_irqrestore(&gpc->lock, ...) | Rename "cache_init" and "cache_destroy" to activate+deactivate to avoid implying that the cache really is destroyed/freed. Note, there more races in the newly named kvm_gpc_activate() that will be addressed separately. [sean: call out that this is a bug fix]
| Date | Event | Detail |
|---|---|---|
| May 1, 2025 | Reserved | Reserved by Linux |
| May 1, 2025 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2022-49884 (Linux). CVSS 7.8 → 4.7 (NVD). |
Authoritative record: CVE-2022-49884 at cve.org
Vendors: linux
Weaknesses: CWE-362
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-49884 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.