CVE-2022-50227 KVM: x86/xen: Initialize Xen timer only once
A missing check in KVM Xen timer initialization causes a kernel crash, allowing local attackers to trigger a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50227?
CVE-2022-50227 is a high-severity vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/xen: Initialize Xen timer only once
Add a check for existing xen timers before initializing a new one.
Currently kvm_xen_init_timer() is called on every KVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG crash when vcpu->arch.xen.timer is already set.
ODEBUG: init active (active state 0) object type: hrtimer hint: xen_timer_callbac0 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Call Trace: __debug_object_init debug_hrtimer_init debug_init hrtimer_init kvm_xen_init_timer kvm_xen_vcpu_set_attr kvm_arch_vcpu_ioctl kvm_vcpu_ioctl vfs_ioctl
Which versions are affected by CVE-2022-50227?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50227?
Apply the vendor's patch.
Is CVE-2022-50227 being exploited?
There is no known exploitation of CVE-2022-50227 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50227, GHSA-48p3-p675-p77f, UBUNTU-CVE-2022-50227.