CVE-2022-39189

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 2, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-39194.8The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perfCVE-2022-391905.5An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to anCVE-2022-391935.3An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose informationCVE-2022-391944.9An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause aCVE-2022-391956.1A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML vCVE-2022-391966.5Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visitinCVE-2022-391976.1An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTMCVE-2022-391989.8A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.CVE-2022-391995.9immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between differeCVE-2022-39207.5HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endCVE-2022-392005.3Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_eventsCVE-2022-392017.5Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and
CVE-2022-39189: High severity, CVSS 7.8 | Vulnix