CVE-2022-50720: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50720 is a vulnerability in the Linux kernel's x86 APIC subsystem where the kernel fails to respect the x2APIC locked mode enforced by the BIOS, potentially allowing the legacy xAPIC MMIO interface to remain accessible. The flaw is related to the "APIC Leak" (AEPICLeak) issue, which can allow an attacker to extract data from Intel SGX enclaves via the APIC MMIO interface. It affects Linux kernel versions prior to the fixes introduced in stable releases 5.19.17, 6.0.3, and 6.1. The CVE was published on December 24, 2025, and carries an EPSS score of approximately 0.017% (very low), with no CVSS base score assigned by the assigner (Feedly, ENISA EUVD).

The root cause is the Linux kernel's x86 APIC initialization code not checking the IA32_XAPIC_DISABLE_STATUS MSR before attempting to disable x2APIC or revert to legacy xAPIC mode. On platforms where the BIOS has set the LEGACY_XAPIC_DISABLED bit (typically when SGX or TDX are enabled), such an attempt causes a General Protection (#GP) fault. The underlying security concern is the AEPICLeak vulnerability (aepicleak.com), which demonstrates that the xAPIC MMIO interface can leak stale data from CPU internal buffers, enabling SGX enclave data extraction. The fix introduces handling for the new MSR so the kernel avoids disabling x2APIC when it is locked, preventing the GP fault and closing the MMIO attack surface (Feedly).

If the kernel attempts to disable x2APIC on a platform where it is locked, a General Protection fault occurs, which can cause a kernel panic and denial of service. More critically, on systems where the lock is not enforced (i.e., unpatched kernels that allow reversion to xAPIC mode), the legacy APIC MMIO interface may be accessible, enabling the AEPICLeak attack — a side-channel that allows a privileged local attacker to extract confidential data from Intel SGX enclaves, undermining the confidentiality guarantees of SGX-protected workloads (Feedly, ENISA EUVD).

The Linux kernel fix was backported to stable releases 5.19.17, 6.0.3, and 6.1. Administrators should update to these or later kernel versions. The fix introduces support for the IA32_XAPIC_DISABLE_STATUS MSR and prevents the kernel from attempting to disable x2APIC when the LEGACY_XAPIC_DISABLED bit is set. As an alternative mitigation at the platform level, disabling SGX and TDX in the BIOS will prevent the BIOS from setting the lock bit, though this removes SGX/TDX protections. Upgrading the kernel is the recommended approach (Feedly, ENISA EUVD).