CVE-2022-4994: Linux Kernel KVM x86 PIO Vulnerability

CVE-2022-4994 Overview

CVE-2022-4994 is a Linux kernel change in the KVM (Kernel-based Virtual Machine) x86 subsystem. The commit reworks how fast Port I/O (PIO) IN operations reach the emulator. Fast PIO now calls __emulator_pio_in() directly instead of bouncing through emulator_pio_in(). The change is documented as a pure no-op with no functional change intended, since vcpu->arch.pio.count is guaranteed to be 0 at that call site.

The NVD entry lacks a severity rating, CVSS vector, affected product list, or CWE assignment. Consumers should treat this record as a kernel code-quality change rather than a defined exploitable defect.

Critical Impact
No exploitation vector, affected version range, or user-facing impact is described in the published CVE record.

Affected Products

Linux kernel (KVM x86 subsystem) — specific vulnerable version range not published in the CVE record
No vendor advisories are linked in the NVD entry beyond the upstream stable-tree commit
No downstream distribution advisories are listed

Discovery Timeline

2026-07-30 - CVE-2022-4994 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2022-4994

Vulnerability Analysis

The change targets the KVM x86 PIO emulation path used when a guest executes an IN instruction on an I/O port. Historically, fast PIO IN routed through emulator_pio_in(), which in turn dispatched to __emulator_pio_in(). After a prior refactor, __emulator_pio_in() began filling the val output directly when handling in-kernel PIO.

With that behavior in place, the intermediate wrapper adds no value for the fast path. The commit therefore calls __emulator_pio_in() directly for fast PIO. After the change, emulator_pio_in_emulated() is the sole remaining caller of emulator_pio_in().

The commit message explicitly states "No functional change intended." No exploit primitive, guest-to-host escape, information disclosure, or denial-of-service condition is described. The NVD record does not assign a CWE or a CVSS score.

Root Cause

The underlying condition is a code-path redundancy in arch/x86/kvm/x86.c. Fast PIO IN unnecessarily invoked a wrapper whose sole added behavior — checking vcpu->arch.pio.count — was guaranteed to observe a value of 0 at that entry point. The commit removes that redundancy.

Attack Vector

No attack vector is documented. The CVE record contains no evidence of exploitability, no proof-of-concept, and no listing in the CISA Known Exploited Vulnerabilities catalog. Because the change is described as a no-op cleanup, an attacker-controlled precondition to produce a security-relevant outcome is not identified in public references.

See the upstream commit for technical context: Linux stable-tree commit dc7a4bfde507.

Detection Methods for CVE-2022-4994

Indicators of Compromise

No indicators of compromise are published for CVE-2022-4994. The upstream record describes a code cleanup with no functional change.
No file hashes, network signatures, or host artifacts are associated with this CVE in the referenced sources.

Detection Strategies

Inventory Linux kernel builds and correlate the presence of commit dc7a4bfde507ffe1d8bef49aba1322f1d20c2cb3 against your patch baseline.
Use configuration management (for example, Ansible, Puppet, or Salt) to report installed kernel package versions across the fleet.
Track distribution security trackers (Debian, Ubuntu USN, Red Hat, SUSE) for any downstream backport referencing this CVE ID.

Monitoring Recommendations

Monitor KVM host kernels for unexpected crashes or guest emulation faults, which remain the general early signal for KVM x86 regressions.
Log dmesg output on hypervisors and forward it to your centralized log platform for retention and search.
Subscribe to the linux-cve-announce mailing list to catch modifications or reclassifications of this CVE entry.

How to Mitigate CVE-2022-4994

Immediate Actions Required

Confirm the running kernel version on all KVM hypervisors using uname -r and compare against your distribution's patched build.
Apply the vendor kernel update that includes upstream commit dc7a4bfde507 once your distribution ships it, following standard change control.
Reboot hosts after kernel package installation so the patched image is loaded into memory.

Patch Information

The fix is delivered by upstream commit dc7a4bfde507ffe1d8bef49aba1322f1d20c2cb3 in the Linux stable tree. Refer to the Kernel Patch Notification for the diff and merge context. Individual Linux distributions may backport this commit into their own supported kernel series; consult the applicable vendor's errata for exact package versions.

Workarounds

No workaround is required or documented. The upstream commit is a code cleanup and does not describe a runtime mitigation.
If you cannot patch immediately, apply standard KVM hardening: restrict who can create or manage guests, and keep guest images isolated from untrusted tenants.

bash

# Verify the running kernel and applied patches on a KVM host
uname -r
# Example for Debian/Ubuntu: list installed kernel packages
dpkg -l | grep linux-image
# Example for RHEL/Rocky/Alma: list installed kernels
rpm -qa kernel
# Confirm KVM module is loaded
lsmod | grep kvm