Security readout for executives and security teams
Plain-English summary
CVE-2022-48995 is a Linux kernel memory leak in the Raydium I2C touchscreen driver. It was found during testing with a BPF mock device. The sources do not show data theft, privilege escalation, remote access, or active exploitation.
Executive priority
Treat as low operational priority unless the organization ships or manages Linux touchscreen devices. Include it in normal kernel patch cycles and embedded firmware maintenance, not emergency response.
Technical view
The leak occurs in raydium_i2c_send() after a BANK_SWITCH command over the I2C bus. The allocated tx_buf is not freed on success or error paths. Kernel stable commits are listed as references for the fix.
Likely exposure
Exposure appears limited to Linux systems using the raydium_ts_i2c touchscreen driver on affected kernel builds. Embedded devices, tablets, kiosks, or appliances with Raydium I2C touch hardware are more likely exposed than general servers.
Exploitation context
The bundle marks KEV as false and provides no exploit reports. The evidence describes a test-discovered kmemleak during device probing and initialization, not a public exploitation technique or network-reachable issue.
Researcher notes
Evidence is narrow: a kernel driver memory leak tied to Raydium I2C touchscreen initialization. No CVSS, CWE, exploitability analysis, or distribution-specific fixed package list is present in the bundle.
Mitigation direction
- Inventory systems using the raydium_ts_i2c kernel driver.
- Update to a vendor kernel containing the cited stable fix commits.
- Prioritize embedded or touchscreen-enabled Linux fleets first.
- Check distribution advisories before assuming a fixed package version.
Validation and detection
- Confirm the running kernel version and vendor patch level.
- Check whether raydium_ts_i2c is built, loaded, or enabled.
- Review vendor changelogs for CVE-2022-48995 or referenced commit hashes.
- Use kernel memory-leak diagnostics only in approved test environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48995 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a82869ac52f3d9db4b2cf8fd41edc2dee7a75a61CVE reference, Linux
- https://git.kernel.org/stable/c/53b9b1201e34ccc895971218559123625c56fbcdCVE reference, Linux
- https://git.kernel.org/stable/c/097c1c7a28e3da8f2811ba532be6e81faab15aabCVE reference, Linux
- https://git.kernel.org/stable/c/8c9a59939deb4bfafdc451100c03d1e848b4169bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.