Security readout for executives and security teams
Plain-English summary
CVE-2022-48945 is a Linux kernel flaw in the vivid media driver. A boundary check was missing after compose height adjustment, causing a kernel page fault in testing. The available sources do not provide CVSS severity or evidence of real-world exploitation.
Executive priority
Track as a kernel maintenance issue until vendor severity is clarified. Prioritize patching where media test drivers are enabled, but do not treat it as confirmed active exploitation based on the supplied evidence.
Technical view
The issue affects the Linux kernel media vivid path. In the V4L2_SEL_TGT_CROP case, compose height could exceed bounds before buffer filling, leading to supervisor write page fault during memcpy. The fix adds v4l2_rect_map_inside() boundary handling.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with the vivid media driver present and usable. The source lists affected Linux versions including 3.18 through 6.2, but distribution backports may change package-level exposure.
Exploitation context
The cited evidence is a syzkaller-discovered kernel crash trace. KEV is false, and the source bundle provides no public exploitation evidence, no exploit maturity detail, and no confirmed attacker scenario.
Researcher notes
The source data is limited to the kernel fix narrative, affected version list, and stable commit references. No CVSS, CWE, attacker prerequisites, or exploitability analysis is supplied, so validation should focus on kernel provenance and driver reachability.
Mitigation direction
- Apply a Linux kernel update containing the referenced stable fix commits.
- Check distribution vendor advisories for backported fixed kernel packages.
- Prioritize systems where the vivid media driver is built, loaded, or accessible.
- If vivid is unnecessary, follow vendor-supported guidance to reduce or remove exposure.
Validation and detection
- Inventory Linux kernel versions against vendor fixed package guidance.
- Check whether the vivid media driver is enabled, available, or loaded.
- Confirm deployed kernels include one of the referenced stable fixes or equivalent backport.
- Review kernel logs for related vivid crashes, without treating logs as proof of exploitation.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 8c0ee15d9a102c732d0745566d254040085d5663
- Linux stable commit 5edc3604151919da8da0fb092b71d7dce07d848a
- Linux stable commit 9c7fba9503b826f0c061d136f8f0c9f953ed18b9
- Linux stable commit 54f259906039dbfe46c550011409fa16f72370f6
- Linux stable commit f9d19f3a044ca651b0be52a4bf951ffe74259b9f
- Linux stable commit ab54081a2843aefb837812fac5488cc8f1696142
- Linux stable commit ccb5392c4fea0e7d9f7ab35567e839d74cb3998b
- Linux stable commit 2f558c5208b0f70c8140e08ce09fcc84da48e789
- Linux stable commit 94a7ad9283464b75b12516c5512541d467cefcf8
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48945 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8c0ee15d9a102c732d0745566d254040085d5663CVE reference, Linux
- https://git.kernel.org/stable/c/5edc3604151919da8da0fb092b71d7dce07d848aCVE reference, Linux
- https://git.kernel.org/stable/c/9c7fba9503b826f0c061d136f8f0c9f953ed18b9CVE reference, Linux
- https://git.kernel.org/stable/c/54f259906039dbfe46c550011409fa16f72370f6CVE reference, Linux
- https://git.kernel.org/stable/c/f9d19f3a044ca651b0be52a4bf951ffe74259b9fCVE reference, Linux
- https://git.kernel.org/stable/c/ab54081a2843aefb837812fac5488cc8f1696142CVE reference, Linux
- https://git.kernel.org/stable/c/ccb5392c4fea0e7d9f7ab35567e839d74cb3998bCVE reference, Linux
- https://git.kernel.org/stable/c/2f558c5208b0f70c8140e08ce09fcc84da48e789CVE reference, Linux
- https://git.kernel.org/stable/c/94a7ad9283464b75b12516c5512541d467cefcf8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.