CVE-2022-1158: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.

Affected products

• Fedoraproject Fedora: version 36 only
• Linux Linux Kernel: from 5.2, before 5.4.189 (fixed in 5.4.189); from 5.5, before 5.10.110 (fixed in 5.10.110); from 5.11, before 5.15.33 (fixed in 5.15.33); from 5.16, before 5.16.19 (fixed in 5.16.19); from 5.17, before 5.17.2 (fixed in 5.17.2)
• Red Hat Enterprise Linux: version 8.0 only; version 9.0 only

Published 2022-08-05. Last modified 2026-06-17.