Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can expose uninitialized memory during a narrow block-device read edge case. The business risk is information disclosure, not system takeover, integrity loss, or service outage based on the supplied record.
Executive priority
Treat as a high-priority kernel confidentiality issue for Linux fleets, especially storage, virtualization, and forensic-processing systems. It is not evidenced as actively exploited in the supplied sources, so prioritize through standard emergency patch governance rather than incident response.
Technical view
bio_truncate() used the wrong page offset when clearing data beyond the last block of a block device. With a truncated or corrupted filesystem and userspace reading the end of the block device, uninitialized data could be returned. CWE-908 applies.
Likely exposure
Exposure is most relevant on Linux systems running affected kernel versions and workloads that permit userspace block-device reads, particularly around damaged, truncated, or unusual filesystems. The supplied affected-version data is incomplete and contains no CPEs.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The CVSS vector rates it 7.5 high, but the described trigger is a specific kernel block-layer edge case rather than a documented public exploit path.
Researcher notes
Key uncertainty is affected-version precision: the bundle lists commit identifiers and several kernel versions but no CPEs. Validate against distro backports, because package versions may not match upstream kernel numbers. Avoid assuming exploitability beyond the described bio_truncate() read-edge condition.
Mitigation direction
- Apply vendor-supported Linux kernel updates that include the referenced stable fixes.
- Check distribution advisories for the exact fixed package version in each environment.
- Restrict unnecessary direct block-device access by users and services.
- Prioritize systems processing untrusted disk images or damaged filesystems.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, containers hosts, and storage nodes.
- Map kernels against vendor advisories or the referenced stable commits.
- Review whether unprivileged or service accounts can read block devices.
- Confirm patched systems no longer run affected kernel builds.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 6cbf4c731d7812518cd857c2cfc3da9fd120f6ae
- Linux stable commit b63e120189fd92aff00096d11e2fc5253f60248b
- Linux stable commit 4633a79ff8bc82770486a063a08b55e5162521d8
- Linux stable commit 941d5180c430ce5b0f7a3622ef9b76077bfa3d82
- Linux stable commit 3ee859e384d453d6ac68bfd5971f630d9fa46ad3
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-48747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6cbf4c731d7812518cd857c2cfc3da9fd120f6aeCVE reference, Linux
- https://git.kernel.org/stable/c/b63e120189fd92aff00096d11e2fc5253f60248bCVE reference, Linux
- https://git.kernel.org/stable/c/4633a79ff8bc82770486a063a08b55e5162521d8CVE reference, Linux
- https://git.kernel.org/stable/c/941d5180c430ce5b0f7a3622ef9b76077bfa3d82CVE reference, Linux
- https://git.kernel.org/stable/c/3ee859e384d453d6ac68bfd5971f630d9fa46ad3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.