Security readout for executives and security teams
Plain-English summary
CVE-2022-49209 is a Linux kernel memory leak in BPF sockmap TCP send handling. A local, low-privileged user could trigger resource exhaustion, creating an availability risk rather than data theft or tampering.
Executive priority
Schedule remediation through normal kernel patch cycles, with higher priority for shared Linux infrastructure where local users or workloads are less trusted. There is no source-backed evidence here of active exploitation, but availability impact can matter on critical hosts.
Technical view
The issue is a CWE-401 memory leak in tcp_bpf_sendmsg when sk_msg_alloc returns ENOMEM after partial allocation while sk_msg is full. The fix trims partially allocated sk_msg memory inside sk_msg_alloc, covering similar call paths such as tls_sw_sendmsg.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with reachable local user execution. The bundle lists Linux as affected with version markers including 4.20, 5.4.189, 5.10.110, 5.15.33, 5.16.19, 5.17.2, and 5.18. Distribution impact requires package-level confirmation.
Exploitation context
The CVSS vector is local, low complexity, low privilege, no user interaction, and high availability impact. The source bundle does not show KEV listing or cited evidence of active exploitation. Treat this as a local denial-of-service risk unless vendor advisories say otherwise.
Researcher notes
Validation should focus on kernel provenance and branch-specific fixes. The bundle references multiple stable commits but does not provide distribution backport status. Avoid assuming exploitability beyond local low-privilege availability impact unless additional vendor or KEV evidence emerges.
Mitigation direction
- Apply the relevant Linux kernel stable update for each affected kernel branch.
- Check your distribution vendor advisory for the packaged kernel fix status.
- Prioritize multi-user servers, container hosts, and shared compute environments.
- Use normal kernel rollout safeguards, including reboot planning and regression checks.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and container hosts.
- Map each kernel to the distribution vendor’s fixed package or stable commit.
- Confirm BPF sockmap exposure assumptions with platform owners.
- After patching, verify the running kernel version, not just installed packages.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 6d03722c34d9603df325f67c6d30dc1b7b3c6067
- Linux stable commit bec34a91eba3483e1830c02bdd36f8f968642047
- Linux stable commit de3a8d8fab0710186f7864ec812836d8d70da3c9
- Linux stable commit f677328f05f52d535cbdc15cb04476db49477eb4
- Linux stable commit d0b85dfc6f01d26808e2576c6537c131b590e270
- Linux stable commit 9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49209 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6d03722c34d9603df325f67c6d30dc1b7b3c6067CVE reference, Linux
- https://git.kernel.org/stable/c/bec34a91eba3483e1830c02bdd36f8f968642047CVE reference, Linux
- https://git.kernel.org/stable/c/de3a8d8fab0710186f7864ec812836d8d70da3c9CVE reference, Linux
- https://git.kernel.org/stable/c/f677328f05f52d535cbdc15cb04476db49477eb4CVE reference, Linux
- https://git.kernel.org/stable/c/d0b85dfc6f01d26808e2576c6537c131b590e270CVE reference, Linux
- https://git.kernel.org/stable/c/9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.