GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49565 (GCVE-0-2022-49565)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:23 – Updated: 2026-05-11 19:02
VLAI
Title
perf/x86/intel/lbr: Fix unchecked MSR access error on HSW
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW The fuzzer triggers the below trace. [ 7763.384369] unchecked MSR access error: WRMSR to 0x689 (tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4 (native_write_msr+0x4/0x20) [ 7763.397420] Call Trace: [ 7763.399881] <TASK> [ 7763.401994] intel_pmu_lbr_restore+0x9a/0x1f0 [ 7763.406363] intel_pmu_lbr_sched_task+0x91/0x1c0 [ 7763.410992] __perf_event_task_sched_in+0x1cd/0x240 On a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is disabled, a TSX quirk is required to access LBR from registers. The lbr_from_signext_quirk_needed() is introduced to determine whether the TSX quirk should be applied. However, the lbr_from_signext_quirk_needed() is invoked before the intel_pmu_lbr_init(), which parses the LBR format information. Without the correct LBR format information, the TSX quirk never be applied. Move the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init(). Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is not required anymore. Both LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but only the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments accordingly.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ac7fd8159a842b3aa51f0b46a351fa3eeb8fbf3 , < 625bcd0685a1612225df83468c83412fc0edb3d7 (git)
Affected: 1ac7fd8159a842b3aa51f0b46a351fa3eeb8fbf3 , < b0380e13502adf7dd8be4c47d622c3522aae6c63 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 5.18.15 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/lbr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "625bcd0685a1612225df83468c83412fc0edb3d7",
              "status": "affected",
              "version": "1ac7fd8159a842b3aa51f0b46a351fa3eeb8fbf3",
              "versionType": "git"
            },
            {
              "lessThan": "b0380e13502adf7dd8be4c47d622c3522aae6c63",
              "status": "affected",
              "version": "1ac7fd8159a842b3aa51f0b46a351fa3eeb8fbf3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/lbr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.15",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/lbr: Fix unchecked MSR access error on HSW\n\nThe fuzzer triggers the below trace.\n\n[ 7763.384369] unchecked MSR access error: WRMSR to 0x689\n(tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4\n(native_write_msr+0x4/0x20)\n[ 7763.397420] Call Trace:\n[ 7763.399881]  \u003cTASK\u003e\n[ 7763.401994]  intel_pmu_lbr_restore+0x9a/0x1f0\n[ 7763.406363]  intel_pmu_lbr_sched_task+0x91/0x1c0\n[ 7763.410992]  __perf_event_task_sched_in+0x1cd/0x240\n\nOn a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is\ndisabled, a TSX quirk is required to access LBR from registers.\nThe lbr_from_signext_quirk_needed() is introduced to determine whether\nthe TSX quirk should be applied. However, the\nlbr_from_signext_quirk_needed() is invoked before the\nintel_pmu_lbr_init(), which parses the LBR format information. Without\nthe correct LBR format information, the TSX quirk never be applied.\n\nMove the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init().\nChecking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is\nnot required anymore.\n\nBoth LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but\nonly the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments\naccordingly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:02:24.606Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/625bcd0685a1612225df83468c83412fc0edb3d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0380e13502adf7dd8be4c47d622c3522aae6c63"
        }
      ],
      "title": "perf/x86/intel/lbr: Fix unchecked MSR access error on HSW",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49565",
    "datePublished": "2025-02-26T02:23:11.213Z",
    "dateReserved": "2025-02-26T02:21:30.410Z",
    "dateUpdated": "2026-05-11T19:02:24.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49565",
      "date": "2026-09-16",
      "epss": "0.00218",
      "percentile": "0.12367"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49565\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:32.240\",\"lastModified\":\"2026-06-17T05:18:27.970\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/x86/intel/lbr: Fix unchecked MSR access error on HSW\\n\\nThe fuzzer triggers the below trace.\\n\\n[ 7763.384369] unchecked MSR access error: WRMSR to 0x689\\n(tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4\\n(native_write_msr+0x4/0x20)\\n[ 7763.397420] Call Trace:\\n[ 7763.399881]  \u003cTASK\u003e\\n[ 7763.401994]  intel_pmu_lbr_restore+0x9a/0x1f0\\n[ 7763.406363]  intel_pmu_lbr_sched_task+0x91/0x1c0\\n[ 7763.410992]  __perf_event_task_sched_in+0x1cd/0x240\\n\\nOn a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is\\ndisabled, a TSX quirk is required to access LBR from registers.\\nThe lbr_from_signext_quirk_needed() is introduced to determine whether\\nthe TSX quirk should be applied. However, the\\nlbr_from_signext_quirk_needed() is invoked before the\\nintel_pmu_lbr_init(), which parses the LBR format information. Without\\nthe correct LBR format information, the TSX quirk never be applied.\\n\\nMove the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init().\\nChecking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is\\nnot required anymore.\\n\\nBoth LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but\\nonly the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments\\naccordingly.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf/x86/intel/lbr: Se corrige el error de acceso a MSR sin verificar en HSW. El fuzzer activa el siguiente seguimiento. [ 7763.384369] Error de acceso a MSR sin marcar: WRMSR a 0x689 (intent\u00f3 escribir 0x1fffffff8101349e) en rIP: 0xffffffff810704a4 (native_write_msr+0x4/0x20) [ 7763.397420] Seguimiento de llamadas: [ 7763.399881]  [ 7763.401994] intel_pmu_lbr_restore+0x9a/0x1f0 [ 7763.406363] intel_pmu_lbr_sched_task+0x91/0x1c0 [ 7763.410992] __perf_event_task_sched_in+0x1cd/0x240 Activado una m\u00e1quina con el formato LBR LBR_FORMAT_EIP_FLAGS2, cuando el TSX est\u00e1 deshabilitado, se requiere una peculiaridad TSX para acceder al LBR desde los registros. Se introduce lbr_from_signext_quirk_needed() para determinar si se debe aplicar la peculiaridad TSX. Sin embargo, lbr_from_signext_quirk_needed() se invoca antes de intel_pmu_lbr_init(), que analiza la informaci\u00f3n del formato LBR. Sin la informaci\u00f3n correcta del formato LBR, la peculiaridad TSX nunca se aplicar\u00e1. Mueva lbr_from_signext_quirk_needed() a intel_pmu_lbr_init(). Ya no es necesario comprobar x86_pmu.lbr_has_tsx en lbr_from_signext_quirk_needed(). Tanto LBR_FORMAT_EIP_FLAGS2 como LBR_FORMAT_INFO tienen el indicador LBR_TSX, pero solo LBR_FORMAT_EIP_FLAGS2 requiere esta caracter\u00edstica. Actualice los comentarios en consecuencia.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/events/intel/lbr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1ac7fd8159a842b3aa51f0b46a351fa3eeb8fbf3\",\"lessThan\":\"625bcd0685a1612225df83468c83412fc0edb3d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1ac7fd8159a842b3aa51f0b46a351fa3eeb8fbf3\",\"lessThan\":\"b0380e13502adf7dd8be4c47d622c3522aae6c63\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/events/intel/lbr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.15\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17.1\",\"versionEndExcluding\":\"5.18.15\",\"matchCriteriaId\":\"DD111315-934C-4445-9E67-018662FB8909\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A59F7FD3-F505-48BD-8875-F07A33F42F6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2D2677C-5389-4AE9-869D-0F881E80D923\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA3917C-C322-4D92-912D-ECE45B2E7416\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"BED18363-5ABC-4639-8BBA-68E771E5BB3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F635F96-FA0A-4769-ADE8-232B3AC9116D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD39FE73-2A9D-4C92-AE7A-CA22F84B228D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF8547FC-C849-4F1B-804B-A93AE2F04A92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3068028-F453-4A1C-B80F-3F5609ACEF60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E9C0DB0-D349-489F-A3D6-B77214E93A8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"00AE778B-BAEE-49EB-9F84-003B73D7862A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C178431E-AD82-4B3D-B70F-A273A02ABD5D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/625bcd0685a1612225df83468c83412fc0edb3d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0380e13502adf7dd8be4c47d622c3522aae6c63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:38:58+00:00",
      "cve": "CVE-2022-49565",
      "id": "CVE-2022-49565",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49565.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:27:23Z",
      "cve": "CVE-2022-49565",
      "id": "CVE-2022-49565",
      "initial_release_date": "2025-02-27T03:04:55Z",
      "product_status:known_affected": "364",
      "product_status:known_not_affected": "409",
      "product_status:recommended": "127",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49565",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49565.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.