LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49226: net: asix: add proper error handling of usb read errors

In the Linux kernel, the following vulnerability has been resolved: net: asix: add proper error handling of usb read errors Syzbot once again hit uninit value in asix driver. The problem still the same -- asix_read_cmd() reads less bytes, than was requested by caller. Since all read requests are performed via asix_read_cmd() let's catch usb related error there and add __must_check notation to be sure all callers actually check return value. So, this patch adds sanity check inside asix_read_cmd(), that simply checks if bytes read are not less, than was requested and adds missing error handling of asix_read_cmd() all across the driver code.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49226 is a Linux kernel issue in the ASIX USB Ethernet driver. The driver could mishandle short USB read results, leaving uninitialized values in use. Business risk is highest on systems that allow or rely on ASIX USB network adapters. Public sources do not report active exploitation or a CVSS score.

Executive priority

Treat as a targeted kernel maintenance issue, not an emergency based on current public evidence. Prioritize patching for Linux endpoints, appliances, labs, and virtualization hosts with USB exposure. Fold remediation into normal kernel update cycles unless your environment permits untrusted USB devices.

Technical view

The kernel fix adds validation in asix_read_cmd() to treat USB reads returning fewer bytes than requested as errors, and enforces caller return-value checks. The CVE record says syzbot found an uninitialized-value condition in the asix driver. The issue is resolved by upstream stable commits referenced in the CVE record.

Likely exposure

Exposure is most plausible on Linux systems with the ASIX USB Ethernet driver present, enabled, or loaded, especially where USB network adapters can be attached. The provided CVE data lists Linux kernel versions including 4.9, 5.15.33, 5.16.19, 5.17.2, and 5.18 as affected, but distribution-specific status requires vendor confirmation.

Exploitation context

The source bundle does not show KEV listing, public exploitation, exploit maturity, or remote attack evidence. Context suggests a USB-driver parsing/error-handling flaw, so practical exposure likely depends on local or physical USB device interaction, or environments passing USB devices into systems.

Researcher notes

Evidence is limited to the CVE record and upstream kernel commits. No CWE, CVSS, exploit details, or downstream vendor matrix are provided. The core condition is short USB reads in asix_read_cmd() causing missing error handling and possible uninitialized-value use across driver callers.

Mitigation direction

  • Check Linux distribution security advisories for CVE-2022-49226.
  • Update affected kernels to builds containing the referenced upstream stable fixes.
  • Restrict untrusted USB device attachment on sensitive Linux systems.
  • Disable or avoid ASIX USB Ethernet adapters where not required.
  • Prioritize systems with physical USB exposure or USB passthrough.

Validation and detection

  • Inventory Linux hosts using or allowing ASIX USB Ethernet adapters.
  • Check whether the asix driver is present, enabled, or loaded.
  • Compare installed kernel builds against vendor advisories for this CVE.
  • Confirm the kernel includes one of the referenced stable commits.
  • Review change management records for kernel updates after vendor remediation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49226 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd9fe64e511144c1ee7d7555b4111f09dde9692ef, d9fe64e511144c1ee7d7555b4111f09dde9692ef, d9fe64e511144c1ee7d7555b4111f09dde9692ef, d9fe64e511144c1ee7d7555b4111f09dde9692efunaffected
LinuxLinux4.9, 0, 5.15.33, 5.16.19, 5.17.2, 5.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.