CVE-2022-50851: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50851 is a kernel crash vulnerability in the Linux kernel's vhost_vdpa driver, triggered when a guest attempts to unmap a large memory region in a vIOMMU context. The bug causes a kernel BUG assertion in drivers/iommu/intel/iommu.c at line 1174 (domain_unmap), leading to a system crash. It was published on December 30, 2025, and affects the Linux kernel (specific stable branches). The estimated CVSS severity is Medium (Feedly).

The root cause is improper handling of large memory unmap operations in the vhost_vdpa subsystem when operating under a virtual IOMMU (vIOMMU). When a guest issues an unmap request for a very large memory range, the kernel attempts to unmap memory regions that may not be tracked in the IOTLB, triggering a BUG assertion in the Intel IOMMU driver's domain_unmap function (CWE-703: Improper Check or Handling of Exceptional Conditions). The fix introduces a new function vhost_vdpa_general_unmap() that restricts unmapping to only those memory regions recorded in the IOTLB, preventing the invalid operation. The crash call trace shows the fault originating from qemu-system-x86 on a Q35 platform running a 6.0.0-rc1 kernel (Feedly).

Successful triggering of this vulnerability results in a kernel panic (crash) on the host system, causing a complete loss of availability for all workloads running on the affected host. Because the crash is triggered by a guest VM operation, a malicious or misbehaving guest could potentially cause a denial-of-service condition on the hypervisor host. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2022-50851. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to control guest memory unmap operations, limiting the attack surface to environments running Linux-based hypervisors with vhost_vdpa and vIOMMU enabled (Feedly).

The Linux kernel maintainers have resolved this issue by introducing the vhost_vdpa_general_unmap() function, which limits unmap operations to memory regions tracked in the IOTLB. Patches are available in the stable kernel tree via commits 8b258a31c2e8, 26b7400c89b8, and e794070af224 on kernel.org. Administrators should update to a patched kernel version that includes these fixes. As a workaround, disabling vIOMMU for guest VMs using vhost_vdpa can prevent the crash until a patched kernel is applied (Feedly).