Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2022-2196

Speculative execution attacks in KVM VMX

CVSS 5.8 MediumEPSS 0.0035 · 29th percentile

Published by the CVE Program (CNA: Google) at 9 Jan 2023, 10:59 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux Kernel Package name: KVM
  • affected 64b8f33b2e1e687d465b5cb382e7bec495f1e026 to before f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b git
  • affected e089a83fbc55b8057f332c00f125acaa02b08ef7 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 git
  • affected 02a3868d18fe639363f1cea6e6d7914513198e43 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 git
  • affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 1b0cafaae8884726c597caded50af185ffc13349 git
  • affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 6b539a7dbb49250f92515c2ba60aea239efc9e35 git
  • affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 63fada296062e91ad9f871970d4e7f19e21a6a15 git
  • affected 5c911beff20aa8639e7a1f28988736c13e03ed54 to before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 git
  • affected 5.4.47 to before 5.4.233 semver
  • affected 5.6.19 to before 5.7.0 semver
  • affected 5.7.3 to before 5.8.0 semver
  • affected 5.8.0 to before 5.10.170 semver
  • affected 5.11.0 to before 5.15.96 semver
  • and 2 more
Other versions: unaffected
Identifiers
CVE-2022-2196
CNA
Google
Weakness (CWE)
CWE-1188
Tags
Published
9 Jan 2023
Updated
7 Aug 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
5.8 Medium 3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L CNA (Google)
  • CISA KEV Not listed.
  • EPSS 0.0035, the 29th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 9 Jan 2023. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.