Security readout for executives and security teams
Plain-English summary
CVE-2022-49010 is a Linux kernel core temperature driver bug that can crash the kernel in a specific error path. The issue happens when cleanup code tries to remove sysfs attributes for data that is already NULL or freed. Public sources do not show active exploitation or a CVSS score.
Executive priority
Prioritize normal kernel patch cycles for Linux systems where uptime is important. Escalate if affected hosts use CPU hotplug or have seen related kernel crashes. Current public evidence does not support emergency treatment for internet-exposed compromise.
Technical view
In hwmon coretemp, if coretemp_add_core() errors, pdata->core_data[indx] may already be NULL and freed. Passing it to sysfs_remove_group() during coretemp_cpu_offline can cause a kernel NULL pointer dereference. The upstream fix adds a NULL check before removing the sysfs group.
Likely exposure
Exposure is most relevant to Linux systems using the coretemp hwmon driver and CPU offline/hotplug paths. The source lists Linux kernel versions as affected, but distro-specific status and fixed package versions are not provided in the bundle.
Exploitation context
The provided evidence shows a crash during CPU offline handling after a duplicate sysfs filename condition. There is no KEV listing and no cited source indicating active exploitation. Practical exploitability beyond denial-of-service is not established here.
Researcher notes
The bundle lacks CVSS, CWE, distro advisories, and exploitability analysis. Treat impact as availability-focused based on the reported kernel oops. Validate affectedness against exact kernel trees or distribution backports rather than relying only on upstream version labels.
Mitigation direction
- Update to a Linux kernel build containing the referenced stable fixes.
- Check your Linux distribution advisory for backported fixes and package names.
- Avoid unnecessary CPU offline or hotplug operations until patched, where operationally feasible.
Validation and detection
- Inventory Linux kernel versions across affected server and workstation fleets.
- Confirm whether vendor kernels include one of the referenced stable commits.
- Review kernel logs for coretemp, sysfs duplicate filename, or NULL pointer dereference messages.
- Verify coretemp hwmon usage on systems where CPU hotplug is operationally relevant.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49010 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fb503d077ff7b43913503eaf72995d1239028b99CVE reference, Linux
- https://git.kernel.org/stable/c/070d5ea4a0592a37ad96ce7f7b6b024f90bb009fCVE reference, Linux
- https://git.kernel.org/stable/c/280110db1a7d62ad635b103bafc3ae96e8bef75cCVE reference, Linux
- https://git.kernel.org/stable/c/89eecabe6a47403237f45aafd7d24f93cb973653CVE reference, Linux
- https://git.kernel.org/stable/c/f06e0cd01eab954bd5f2190c9faa79bb5357e05bCVE reference, Linux
- https://git.kernel.org/stable/c/7692700ac818866d138a8de555130a6e70e6ac16CVE reference, Linux
- https://git.kernel.org/stable/c/ae6c8b6e5d5628df1c475c0a8fca1465e205c95bCVE reference, Linux
- https://git.kernel.org/stable/c/a89ff5f5cc64b9fe7a992cf56988fd36f56ca82aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.