CVE-2022-50224: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50224 is a Linux kernel vulnerability in the KVM (Kernel Virtual Machine) x86 MMU (Memory Management Unit) subsystem related to improper handling of the NX (No-Execute) bit in Nested Page Tables (NPT). When the NX huge page mitigation is enabled, KVM incorrectly treats the NX bit as a reserved SPTE (Shadow Page Table Entry) bit, triggering a kernel WARNING and potentially causing system instability or denial of service. The vulnerability was published on June 18, 2025, and affects multiple Linux kernel versions from 4.9.202 through 5.19.1, as well as Microsoft's CBL2 kernel 5.15.186.1-1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is that KVM's SPTE validity checks for NPT (Nested Page Tables) did not account for the NX bit as a legitimate SPTE bit, classifying it as a reserved bit (CWE-703: Improper Check or Handling of Exceptional Conditions). When the NX huge page mitigation is active, KVM sets the NX bit in SPTEs during make_spte(), which then triggers a WARN assertion at arch/x86/kvm/mmu/spte.c:215 because the bit appears in the reserved mask. The call trace flows through tdp_mmu_map_handle_target_level → kvm_tdp_mmu_map → direct_page_fault → npf_interception in the kvm_amd module. The fix treats NX as a valid SPTE bit when NPT is in use, consistent with the existing requirement that SVM refuse to load without NX support (commit b26a71a1a5b9). Exploitation requires local, low-privilege access to a system running KVM with AMD SVM and NPT enabled alongside the NX huge page mitigation (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation results in a kernel WARNING being triggered during NPT page fault handling, which can cause system instability, unexpected behavior, or denial of service in KVM-based virtualized environments. The impact is limited to availability — there is no confidentiality or integrity impact — but a crash or destabilization of the KVM hypervisor could affect all guest virtual machines running on the host. The vulnerability is particularly relevant to cloud and virtualization infrastructure using AMD processors with NPT and the NX huge page mitigation enabled (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local low-privilege access and a specific hardware/software configuration (AMD SVM with NPT and NX huge page mitigation enabled), further limiting practical exploitability (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing spte = 0x800000..., rsvd bits = 0x800f0000001fe000, and WARNING: CPU: ... at arch/x86/kvm/mmu/spte.c:215 make_spte.
• Process: Unusual KVM-related call traces in kernel logs involving tdp_mmu_map_handle_target_level, kvm_tdp_mmu_map, direct_page_fault, npf_interception, or svm_handle_exit from the kvm_amd module.
• System Behavior: Unexpected guest VM crashes or hypervisor instability on AMD-based KVM hosts with NPT and NX huge page mitigation enabled.

The fix is available in Linux kernel version 5.19.2 and corresponding stable backports. Patches have been committed to the stable kernel tree at two commits: 6271f2854b92 and 6c6ab524cfae (Kernel Patch 1, Kernel Patch 2). Microsoft has also released a patch for its CBL2 kernel (5.15.186.1-1) (Microsoft MSRC). Amazon Linux 2 users should apply the updates referenced in ALAS2KERNEL-5.10-2025-100 and ALAS2KERNEL-5.10-2025-101. As a temporary workaround, disabling the NX huge page mitigation (kvm.nx_huge_pages=off) will prevent the condition from being triggered, though this reduces Spectre/Meltdown mitigations.