# Speculative execution attacks in KVM VMX

CVE record · `CVE-2022-2196`

- **Identifiers:** `CVE-2022-2196`
- **State:** Confirmed
- **Severity:** CVSS 5.8 Medium
- **Critical:** No
- **CNA:** Google
- **Weakness (CWE):** [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html)
- **Tags:** [CWE-1188](https://agentprime.io/advisories/tag/cwe-1188.md)
- **Technologies:** [Linux Kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 9 Jan 2023
- **Updated:** 7 Aug 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Google) at 9 Jan 2023, 10:59 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux Kernel.
  - affected: `64b8f33b2e1e687d465b5cb382e7bec495f1e026 to before f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b` (git)
  - affected: `e089a83fbc55b8057f332c00f125acaa02b08ef7 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5` (git)
  - affected: `02a3868d18fe639363f1cea6e6d7914513198e43 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5` (git)
  - affected: `5c911beff20aa8639e7a1f28988736c13e03ed54 to before 1b0cafaae8884726c597caded50af185ffc13349` (git)
  - affected: `5c911beff20aa8639e7a1f28988736c13e03ed54 to before 6b539a7dbb49250f92515c2ba60aea239efc9e35` (git)
  - affected: `5c911beff20aa8639e7a1f28988736c13e03ed54 to before 63fada296062e91ad9f871970d4e7f19e21a6a15` (git)
  - affected: `5c911beff20aa8639e7a1f28988736c13e03ed54 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5` (git)
  - affected: `5.4.47 to before 5.4.233` (semver)
  - affected: `5.6.19 to before 5.7.0` (semver)
  - affected: `5.7.3 to before 5.8.0` (semver)
  - affected: `5.8.0 to before 5.10.170` (semver)
  - affected: `5.11.0 to before 5.15.96` (semver)
  - and 2 more
  - Other versions: unaffected
  - Package name: `KVM`

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 5.8 Medium, CVSS 3.1: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L`, from CNA (Google)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0035, the 29th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 9 Jan 2023. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2022-2196](https://www.cve.org/CVERecord?id=CVE-2022-2196)
- [NVD: CVE-2022-2196](https://nvd.nist.gov/vuln/detail/CVE-2022-2196)

### References from the CNA

- <https://kernel.dance/#2e7eab81425a>
- <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2e7eab81425ad6c875f2ed47c0ce01e78afc38a5>
- <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b539a7dbb49250f92515c2ba60aea239efc9e35>
- <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b0cafaae8884726c597caded50af185ffc13349>
- <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b>
- <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63fada296062e91ad9f871970d4e7f19e21a6a15>
- <https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2022-2196>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2022-2196/>. Everything for agents: <https://agentprime.io/llms.txt>.