Security readout for executives and security teams
Plain-English summary
CVE-2022-49216 is a Linux kernel flaw in the NVIDIA Tegra display driver path. It leaks a device reference during DSI ganged probing. The published impact is local denial of service, not data theft or privilege escalation. Systems are mainly exposed if they run affected Linux kernels with relevant Tegra DRM/DSI functionality.
Executive priority
Handle as a routine-to-priority availability fix for Tegra Linux fleets. It is not presented as remotely exploitable or actively exploited, but it can affect device stability. Patch during normal kernel maintenance unless critical Tegra devices are exposed to untrusted local users.
Technical view
The issue is in drm/tegra tegra_dsi_ganged_probe. A reference acquired by of_find_device_by_node() was not released when no longer needed. The kernel fix adds put_device(). CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no user interaction, high availability impact only.
Likely exposure
Likely limited to Linux systems using affected kernel builds and Tegra display/DSI components. General-purpose Linux servers without Tegra DRM/DSI hardware or driver use are less likely to be exposed, based on the provided description.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The CVSS vector requires local access with low privileges and targets availability. The sources do not provide exploit details or evidence of weaponization.
Researcher notes
The public record is concise and does not name a CWE. Affected-version semantics in the provided bundle are not fully clear, so validation should rely on vendor kernel package status or presence of the stable fix commit rather than version strings alone.
Mitigation direction
- Check your Linux distribution or device vendor advisory for a kernel update including the fix.
- Prioritize updates for Tegra-based systems using DRM/DSI display functionality.
- If maintaining kernels, ensure the relevant stable kernel commit is included.
- Where updates are unavailable, review vendor guidance for safe operational workarounds.
Validation and detection
- Inventory Linux kernel versions on Tegra-based devices.
- Confirm whether Tegra DRM/DSI support is enabled or in use.
- Check kernel source or package changelog for the referenced stable commit.
- Use vendor security advisories to map package versions to the CVE fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49216 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0e2f4e434e71dffd1085c3dccd676514bd71d316CVE reference, Linux
- https://git.kernel.org/stable/c/5e8fdb6392d945d33fef959eab73f8c34bc0a63bCVE reference, Linux
- https://git.kernel.org/stable/c/2d6ae8b747fe55f54de4a4441d636974aa53f56aCVE reference, Linux
- https://git.kernel.org/stable/c/a725070701883fe62266ee6d2f31d67e6cdd31dfCVE reference, Linux
- https://git.kernel.org/stable/c/1e06710c43a090f14bb67714265a01cd1d7a37c5CVE reference, Linux
- https://git.kernel.org/stable/c/852c1f5f3119a38ee68e319bab10277fc1ab06b7CVE reference, Linux
- https://git.kernel.org/stable/c/cd78b74031cbc94133965f1017deb822657fc1a6CVE reference, Linux
- https://git.kernel.org/stable/c/f3c99c686e098300c246e5e8a1474133e3dacb05CVE reference, Linux
- https://git.kernel.org/stable/c/221e3638feb8bc42143833c9a704fa89b6c366bbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.