CVE-2022-48765: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48765 affects the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. The vulnerability was discovered in the LAPIC (Local Advanced Programmable Interrupt Controller) timer handling during guest reboot operations. The issue occurs when tsc-deadline mode is not exposed and a guest reboot is performed, where lapic_shutdown() clears APIC state with LVT_MASKED and timer-mode bit set to 0 (Kernel Git).

The vulnerability stems from the lapic_shutdown() function, which is called in the sys_reboot path. The function only masks LVTT without disarming the flying timer. When the APIC state is cleared with LVT_MASKED and timer-mode bit set to 0, it can trigger an unintended timer-mode switch between tsc-deadline and oneshot/periodic modes, resulting in the preemption timer being cancelled in apic_update_lvtt() (Kernel Git).

The vulnerability can cause system warnings and potential timing issues during guest reboot operations in KVM virtualized environments. This manifests as warning messages in the system log when the guest system attempts to reboot (Kernel Git).

The issue can be triggered by not exposing tsc-deadline mode and performing a reboot in the guest system. The vulnerability requires specific conditions to be met and is primarily a reliability issue rather than a security exploit (Kernel Git).

The issue has been fixed by modifying the KVM_SET_LAPIC operation to properly cancel the preemption timer. The fix involves replacing hrtimer_cancel() with cancel_apic_timer() to ensure proper timer cleanup during LAPIC state changes (Kernel Git).