Security readout for executives and security teams
Plain-English summary
This is a Linux kernel bug in the lgdt3306a media driver. If the driver is probed without expected platform_data, the kernel can dereference a null pointer and crash. The public bundle does not show remote exploitation, active exploitation, or broad business impact beyond systems using this specific driver path.
Executive priority
Handle through normal kernel patch management unless the organization operates affected media or embedded Linux systems. There is no source-backed evidence of active exploitation, but kernel crash conditions still matter for reliability-sensitive environments.
Technical view
The flaw is a null pointer dereference in lgdt3306a_probe, observed through KASAN at kmemdup during i2c_device_probe. The kernel fix adds a check that platform_data exists before copying it. Affected Linux kernel versions are listed in the CVE bundle, with stable kernel commit references provided.
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the lgdt3306a media driver present and a probe path where client platform_data is missing. General servers without this media hardware or driver path are less likely to be exposed based on the bundle.
Exploitation context
The bundle marks KEV as false and provides no evidence of active exploitation. The available evidence is a kernel crash log, not a public exploit report. Treat this as a potential local or device-triggered denial-of-service condition unless vendor guidance says otherwise.
Researcher notes
The evidence points to missing input validation for client platform_data in the lgdt3306a probe routine. The source bundle does not provide CVSS, CWE, exploit prerequisites, or a complete version-range interpretation, so validation should rely on kernel branch advisories and the referenced commits.
Mitigation direction
- Update affected Linux kernels to builds containing the referenced stable fixes.
- Check distribution advisories for backported fixes matching your deployed kernel branch.
- Disable or avoid loading the lgdt3306a driver where it is not required.
- Prioritize systems that use media, tuner, or embedded hardware paths involving this driver.
Validation and detection
- Inventory kernel versions and compare them with the CVE bundle affected entries.
- Check whether the lgdt3306a driver is built, loaded, or packaged on target systems.
- Review vendor kernel changelogs for the referenced stable commit IDs.
- Confirm patched systems no longer include the vulnerable lgdt3306a_probe behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48772 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8915dcd29a82096acacf54364a8425363782aea0CVE reference, Linux
- https://git.kernel.org/stable/c/b479fd59a1f4a342b69fce34f222d93bf791dca4CVE reference, Linux
- https://git.kernel.org/stable/c/526238d32c3acc3d597fd8c9a34652bfe9086ceaCVE reference, Linux
- https://git.kernel.org/stable/c/d082757b8359201c3864323cea4b91ea30a1e676CVE reference, Linux
- https://git.kernel.org/stable/c/7d12e918f2994c883f41f22552a61b9310fa1e87CVE reference, Linux
- https://git.kernel.org/stable/c/8e1e00718d0d9dd83337300572561e30b9c0d115CVE reference, Linux
- https://git.kernel.org/stable/c/c1115ddbda9c930fba0fdd062e7a8873ebaf898dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.