Log in Start free

Vulnerability · Published Jul 5, 2022 · Assigned by XEN

CVE-2022-26365

High 7.1

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.1High
Exploit odds (30 days)0.3%top 73.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.16.1-r4ALPINE-CVE-2022-26365
Alpine:v3.21xen4.16.1-r4ALPINE-CVE-2022-26365
Alpine:v3.22xen4.16.1-r4ALPINE-CVE-2022-26365
Alpine:v3.23xen4.16.1-r4ALPINE-CVE-2022-26365
Alpine:v3.24xen4.16.1-r4ALPINE-CVE-2022-26365
Debian:12linux5.18.14-1DEBIAN-CVE-2022-26365
Debian:13linux5.18.14-1DEBIAN-CVE-2022-26365
Debian:14linux5.18.14-1DEBIAN-CVE-2022-26365
Debian:12xen4.16.2-1DEBIAN-CVE-2022-26365
Debian:13xen4.16.2-1DEBIAN-CVE-2022-26365
Debian:14xen4.16.2-1DEBIAN-CVE-2022-26365
Ubuntu:22.04:LTSlinux5.15.0-48.54USN-5624-1
Ubuntu:22.04:LTSlinux5.15.0-48.54UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-aws5.15.0-1020.24USN-5624-1
Ubuntu:22.04:LTSlinux-aws5.15.0-1020.24UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-azure5.15.0-1020.25USN-5624-1
Ubuntu:22.04:LTSlinux-azure5.15.0-1020.25UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1024.30.1UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-gcp5.15.0-1018.24USN-5633-1
Ubuntu:22.04:LTSlinux-gcp5.15.0-1018.24UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-gke5.15.0-1016.19USN-5633-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1016.19UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1003.5UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1003.5USN-5635-1
Ubuntu:22.04:LTSlinux-ibm5.15.0-1015.17UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-ibm5.15.0-1015.17USN-5683-1
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1016.21USN-5655-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1016.21UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-kvm5.15.0-1018.22UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-kvm5.15.0-1018.22USN-5624-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-48.54UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-48.54USN-5624-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-oem-5.175.17.0-1024.25USN-5773-1
Ubuntu:22.04:LTSlinux-oem-5.175.17.0-1024.25UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-oracle5.15.0-1018.23UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-oracle5.15.0-1018.23USN-5640-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1015.17USN-5633-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1015.17UBUNTU-CVE-2022-26365
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSlinux-riscv5.15.0-1019.22UBUNTU-CVE-2022-26365
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-26365
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-26365
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-26365
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-26365
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-26365

Affected products (as reported)

VendorProductVersions
Linux Linux see references
Xen xen see references

References