{"id":"CVE-2022-50425","state":"PUBLISHED","title":"x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly\n\nWhen an extended state component is not present in fpstate, but in init\nstate, the function copies from init_fpstate via copy_feature().\n\nBut, dynamic states are not present in init_fpstate because of all-zeros\ninit states. Then retrieving them from init_fpstate will explode like this:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n ...\n RIP: 0010:memcpy_erms+0x6/0x10\n  ? __copy_xstate_to_uabi_buf+0x381/0x870\n  fpu_copy_guest_fpstate_to_uabi+0x28/0x80\n  kvm_arch_vcpu_ioctl+0x14c/0x1460 [kvm]\n  ? __this_cpu_preempt_check+0x13/0x20\n  ? vmx_vcpu_put+0x2e/0x260 [kvm_intel]\n  kvm_vcpu_ioctl+0xea/0x6b0 [kvm]\n  ? kvm_vcpu_ioctl+0xea/0x6b0 [kvm]\n  ? __fget_light+0xd4/0x130\n  __x64_sys_ioctl+0xe3/0x910\n  ? debug_smp_processor_id+0x17/0x20\n  ? fpregs_assert_state_consistent+0x27/0x50\n  do_syscall_64+0x3f/0x90\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAdjust the 'mask' to zero out the userspace buffer for the features that\nare not available both from fpstate and from init_fpstate.\n\nThe dynamic features depend on the compacted XSAVE format. Ensure it is\nenabled before reading XCOMP_BV in init_fpstate.","publishedAt":"2025-10-01T11:42:04.776Z","updatedAt":"2026-05-11T19:19:14.875Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2308ee57d93d896618dd65c996429c9d3e469fe0","status":"affected","lessThan":"6ff29642fd28965a8f8d6d326ac91bf6075f3113","versionType":"git"},{"version":"2308ee57d93d896618dd65c996429c9d3e469fe0","status":"affected","lessThan":"471f0aa7fa64e23766a1473b32d9ec3f0718895a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/fpu/xstate.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.16","versionType":"semver"},{"version":"6.0.7","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/fpu/xstate.c"]}],"references":["https://git.kernel.org/stable/c/6ff29642fd28965a8f8d6d326ac91bf6075f3113","https://git.kernel.org/stable/c/471f0aa7fa64e23766a1473b32d9ec3f0718895a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50425.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50425","state":"PUBLISHED","datePublished":"2025-10-01T11:42:04.776Z","dateUpdated":"2026-05-11T19:19:14.875Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-17T14:53:07.004Z"},"containers":{"cna":{"title":"x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly\n\nWhen an extended state component is not present in fpstate, but in init\nstate, the function copies from init_fpstate via copy_feature().\n\nBut, dynamic states are not present in init_fpstate because of all-zeros\ninit states. Then retrieving them from init_fpstate will explode like this:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n ...\n RIP: 0010:memcpy_erms+0x6/0x10\n  ? __copy_xstate_to_uabi_buf+0x381/0x870\n  fpu_copy_guest_fpstate_to_uabi+0x28/0x80\n  kvm_arch_vcpu_ioctl+0x14c/0x1460 [kvm]\n  ? __this_cpu_preempt_check+0x13/0x20\n  ? vmx_vcpu_put+0x2e/0x260 [kvm_intel]\n  kvm_vcpu_ioctl+0xea/0x6b0 [kvm]\n  ? kvm_vcpu_ioctl+0xea/0x6b0 [kvm]\n  ? __fget_light+0xd4/0x130\n  __x64_sys_ioctl+0xe3/0x910\n  ? debug_smp_processor_id+0x17/0x20\n  ? fpregs_assert_state_consistent+0x27/0x50\n  do_syscall_64+0x3f/0x90\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAdjust the 'mask' to zero out the userspace buffer for the features that\nare not available both from fpstate and from init_fpstate.\n\nThe dynamic features depend on the compacted XSAVE format. Ensure it is\nenabled before reading XCOMP_BV in init_fpstate."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2308ee57d93d896618dd65c996429c9d3e469fe0","status":"affected","lessThan":"6ff29642fd28965a8f8d6d326ac91bf6075f3113","versionType":"git"},{"version":"2308ee57d93d896618dd65c996429c9d3e469fe0","status":"affected","lessThan":"471f0aa7fa64e23766a1473b32d9ec3f0718895a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/fpu/xstate.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.16","versionType":"semver"},{"version":"6.0.7","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/fpu/xstate.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6ff29642fd28965a8f8d6d326ac91bf6075f3113"},{"url":"https://git.kernel.org/stable/c/471f0aa7fa64e23766a1473b32d9ec3f0718895a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T19:19:14.875Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.0.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}