Security readout for executives and security teams
Plain-English summary
CVE-2022-48803 is a Linux kernel bug in a Texas Instruments PHY clock-divider table. The reported failure is an out-of-bounds read detected by KASAN during device probing on TI J721e hardware. Business urgency is mainly for products or appliances using affected Linux kernels with this TI hardware path enabled.
Executive priority
Prioritize for embedded Linux products using TI J721e hardware. For typical enterprise Linux servers, urgency is likely lower unless this driver path is present. Treat as a targeted maintenance update rather than an internet-scale emergency.
Technical view
The Linux kernel phy/ti driver phy-j721e-wiz.c lacked a sentinel entry in clk_div_table. _get_table_maxdiv() could read past the global array during clock rate handling, producing a KASAN global-out-of-bounds report in probe initialization. Upstream stable references add the sentinel entry.
Likely exposure
Exposure appears limited to Linux systems using the TI J721e WIZ PHY driver path, such as TI J721e-based embedded platforms. General-purpose servers without this hardware or driver path are less likely exposed. The source bundle lists Linux kernel versions as affected but does not provide full distribution mapping.
Exploitation context
No active exploitation is indicated. The CVE is not marked KEV, and the provided sources describe a KASAN-detected out-of-bounds read during initialization, not a public exploit. Practical impact depends on reachable hardware configuration and kernel build.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploitability details, or downstream vendor advisories are provided in the bundle. The observable condition is a global out-of-bounds read in kernel initialization code for a specific TI PHY driver.
Mitigation direction
- Identify products using TI J721e or the phy-j721e-wiz driver.
- Update to a vendor kernel containing the referenced Linux stable fix.
- If using custom kernels, review and apply the relevant upstream stable commit.
- Check Linux distribution or device vendor advisories for supported patched builds.
Validation and detection
- Inventory deployed kernel versions and embedded board families.
- Confirm whether the TI J721e WIZ PHY driver is built or loaded.
- Compare kernel source or changelog against the referenced stable commits.
- Monitor boot and probe logs for related KASAN or out-of-bounds reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48803 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3c75d1017cb362b6a4e0935746ef5da28250919fCVE reference, Linux
- https://git.kernel.org/stable/c/7a360e546ad9e7c3fd53d6bb60348c660cd28f54CVE reference, Linux
- https://git.kernel.org/stable/c/5b0c9569135a37348c1267c81e8b0274b21a86edCVE reference, Linux
- https://git.kernel.org/stable/c/6d1e6bcb31663ee83aaea1f171f3dbfe95dd4a69CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.