CVE-2022-26365: High severity linux kernel vulnerability
Last updated 25 April 2025
Other sources
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26365?
CVE-2022-26365 is considered a high severity vulnerability due to the potential for data leaks.
How do I fix CVE-2022-26365?
To mitigate CVE-2022-26365, update the affected Linux kernel and Xen packages to the latest versions as recommended.
What types of systems are affected by CVE-2022-26365?
CVE-2022-26365 affects various Linux kernel versions and Xen hypervisor products.
What are the consequences of exploiting CVE-2022-26365?
Exploiting CVE-2022-26365 can lead to unauthorized access to sensitive data due to memory disclosure.
Is CVE-2022-26365 a remote code execution vulnerability?
No, CVE-2022-26365 is not classified as a remote code execution vulnerability but rather as a data leakage issue.