Security readout for executives and security teams
Plain-English summary
A Linux kernel race can free an RPMsg control-device object while its character-device component is still being released. A local, low-privileged user may potentially trigger memory corruption with serious confidentiality, integrity, and availability consequences. Exposure depends on the affected RPMsg character-device functionality being present and reachable.
Executive priority
Treat as a high-priority local privilege and stability risk on exposed RPMsg-enabled devices. Inventory affected kernels promptly and deploy vendor-corrected builds, while giving lower priority to systems without the relevant functionality or untrusted local access.
Technical view
The rpmsg_ctrldev structure embeds a managed cdev whose release timing is unpredictable. The former teardown path could free the enclosing structure before cdev cleanup completed, creating an unsafe object-lifetime race. The kernel fix replaces separate cdev add/delete handling with cdev_device_add/del(), which coordinates both lifecycles.
Likely exposure
Most relevant to Linux systems running an affected kernel and exposing the RPMsg character-device control path to local users. The supplied version data is ambiguous, so organizations should compare their exact kernel build against the linked stable commits and distribution guidance.
Exploitation context
CVSS 3.1 rates this 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high impact. The supplied record says it is not in KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The evidence establishes a teardown race and premature free condition but provides no CWE, demonstrated exploit chain, or exploitation telemetry. Exact vulnerable ranges are not safely inferable from the supplied version array. Validate exposure through configuration, interface permissions, vendor backports, and commit ancestry rather than version strings alone.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable linked stable fix.
- Check distribution or device-vendor guidance for the corrected package and required reboot.
- Prioritize systems where local users can reach RPMsg character-device interfaces.
- Where updates are delayed, restrict untrusted local access and monitor affected systems.
Validation and detection
- Record the running kernel version, distribution package release, and device firmware build.
- Determine whether RPMsg character-device support is enabled and reachable by untrusted local users.
- Confirm the applicable stable fix is present in the running kernel source or vendor package.
- After updating and rebooting, verify the corrected kernel is active.
- Review kernel logs for object-lifetime warnings involving rpmsg_ctrldev or cdev cleanup.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48759 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/74d85e9fbc7022a4011102c7474a9c7aeb704a35CVE reference, Linux
- https://git.kernel.org/stable/c/70cb4295ec806b663665e1d2ed15caab6159880eCVE reference, Linux
- https://git.kernel.org/stable/c/da27b834c1e0222e149e06caddf7718478086d1bCVE reference, Linux
- https://git.kernel.org/stable/c/1dbb206730f3e5ce90014ad569ddf8167ec4124aCVE reference, Linux
- https://git.kernel.org/stable/c/85aba11a8ea92a8eef2de95ebbe063086fd62d9cCVE reference, Linux
- https://git.kernel.org/stable/c/d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7CVE reference, Linux
- https://git.kernel.org/stable/c/b7fb2dad571d1e21173c06cef0bced77b323990aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.