vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-50720

x86/apic: Don't disable x2APIC if locked

N/A
Published: December 24, 2025 at 12:22 PM UTC
Updated: June 17, 2026 at 05:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: x86/apic: Don't disable x2APIC if locked The APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC (or x2APIC). X2APIC mode is mostly compatible with legacy APIC, but it disables the memory-mapped APIC interface in favor of one that uses MSRs. The APIC mode is controlled by the EXT bit in the APIC MSR. The MMIO/xAPIC interface has some problems, most notably the APIC LEAK [1]. This bug allows an attacker to use the APIC MMIO interface to extract data from the SGX enclave. Introduce support for a new feature that will allow the BIOS to lock the APIC in x2APIC mode. If the APIC is locked in x2APIC mode and the kernel tries to disable the APIC or revert to legacy APIC mode a GP fault will occur. Introduce support for a new MSR (IA32_XAPIC_DISABLE_STATUS) and handle the new locked mode when the LEGACY_XAPIC_DISABLED bit is set by preventing the kernel from trying to disable the x2APIC. On platforms with the IA32_XAPIC_DISABLE_STATUS MSR, if SGX or TDX are enabled the LEGACY_XAPIC_DISABLED will be set by the BIOS. If legacy APIC is required, then it SGX and TDX need to be disabled in the BIOS. [1]: https://aepicleak.com/aepicleak.pdf

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
3.3 ≤ v < 5.19.173.3 ≤ v < 6.0.33.3 ≤ v < 6.13.3fb209bd891645bb87b9618b724f0b4928e0df3de
Vendor states this is fixed in 05785ba834f23272f9d23427ae4a80ac505a5296 (fixed)
Vendor states this is fixed in b8d1d163604bd1e600b062fb00de5dc42baa355f (fixed)
Vendor states this is fixed in dd1241e00addbf0b95f6cd6ce32152692820657e (fixed)
Vendor states this is fixed in 3.3 (unaffected)
Vendor states this is fixed in 5.19.17 (unaffected)
Vendor states this is fixed in 6.0.3 (unaffected)
Vendor states this is fixed in 6.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (3)

Source: cverecord
https://git.kernel.org/stable/c/05785ba834f23272f9d23427ae4a80ac505a5296
Source: cverecord
https://git.kernel.org/stable/c/dd1241e00addbf0b95f6cd6ce32152692820657e
Source: cverecord
https://git.kernel.org/stable/c/b8d1d163604bd1e600b062fb00de5dc42baa355f

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card