CVE-2022-1789: Debian Linux

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Linux Linux Kernel: before 5.8 (fixed in 5.8)
• Red Hat Enterprise Linux: version 9.0 only

Published 2022-06-02. Last modified 2026-06-17.