LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48762: arm64: extable: fix load_unaligned_zeropad() reg indices

In the Linux kernel, the following vulnerability has been resolved: arm64: extable: fix load_unaligned_zeropad() reg indices In ex_handler_load_unaligned_zeropad() we erroneously extract the data and addr register indices from ex->type rather than ex->data. As ex->type will contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4): * We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is extracted from bits [9:5]. Thus, we may attempt to dereference an arbitrary address as X0 may hold an arbitrary value. * We'll always treat X4 as the data register, since EX_DATA_REG_DATA is extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary behaviour within load_unaligned_zeropad() and its caller. Fix this by extracting both values from ex->data as originally intended. On an MTE-enabled QEMU image we are hitting the following crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: fixup_exception+0xc4/0x108 __do_kernel_fault+0x3c/0x268 do_tag_check_fault+0x3c/0x104 do_mem_abort+0x44/0xf4 el1_abort+0x40/0x64 el1h_64_sync_handler+0x60/0xa0 el1h_64_sync+0x7c/0x80 link_path_walk+0x150/0x344 path_openat+0xa0/0x7dc do_filp_open+0xb8/0x168 do_sys_openat2+0x88/0x17c __arm64_sys_openat+0x74/0xa0 invoke_syscall+0x48/0x148 el0_svc_common+0xb8/0xf8 do_el0_svc+0x28/0x88 el0_svc+0x24/0x84 el0t_64_sync_handler+0x88/0xec el0t_64_sync+0x1b4/0x1b8 Code: f8695a69 71007d1f 540000e0 927df12a (f940014a)

MediumCVSS 6.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug on arm64 systems that can make the kernel use the wrong CPU registers during fault recovery. The documented impact is a kernel crash, causing availability loss. It is a local issue, not a remote internet-facing service flaw.

Executive priority

Treat as a moderate patching item for arm64 Linux fleets. It is availability-focused and local, so prioritize shared hosts, developer systems, CI runners, and environments running untrusted workloads over isolated appliances.

Technical view

The arm64 exception handler for load_unaligned_zeropad() read register indices from ex->type instead of ex->data. Because the type value is fixed, it can treat X0 as the address register and X4 as the data register, causing bad dereferences and register corruption. The upstream fix reads both values from ex->data.

Likely exposure

Exposure is most likely on affected Linux arm64 kernel builds in the 5.16-era range named by the CVE data. Systems without local code execution paths are less exposed. Evidence specifically mentions a crash on an MTE-enabled QEMU image.

Exploitation context

The CVE is not listed as KEV, and the provided sources do not report active exploitation. The demonstrated context is a local kernel crash during normal syscall/path-walk activity, creating denial-of-service risk rather than documented data theft or privilege escalation.

Researcher notes

The evidence supports an arm64-specific exception-table handling defect with availability impact. The source bundle does not establish confidentiality, integrity, remote attack surface, weaponized exploitation, or a standalone mitigation beyond applying the upstream/vendor kernel fix.

Mitigation direction

  • Inventory Linux arm64 systems and record exact kernel versions.
  • Prioritize affected 5.16-era kernels for vendor-supported kernel updates.
  • Verify whether stable commits 47fe7a1c or 3758a6c are present.
  • For managed distributions, follow the distribution kernel advisory and package channel.
  • Restrict untrusted local shell or workload access until patched.

Validation and detection

  • Confirm architecture is arm64 before prioritizing this CVE.
  • Check kernel version against vendor advisories and the CVE affected range.
  • Review kernel changelog for the extable load_unaligned_zeropad fix.
  • Look for unexplained arm64 kernel NULL dereference crashes in logs.
  • Validate patched hosts no longer match the affected kernel build list.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48762 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.2Medium
CVSS 3.1 vector shape for CVE-2022-48762Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux753b32368705c396000f95f33c3b7018474e33ad, 753b32368705c396000f95f33c3b7018474e33adunaffected
LinuxLinux5.16, 0, 5.16.5, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.