Security readout for executives and security teams
Plain-English summary
A flaw in the Linux rtw88 wireless driver can corrupt kernel memory during hardware scanning and may leak memory on error paths. Successful exploitation could compromise confidentiality, integrity, and availability, but the supplied CVSS assessment requires local access with low privileges. Systems not using affected rtw88 code are unlikely to be exposed.
Executive priority
Prioritize affected endpoints and appliances that permit untrusted local users or workloads. Remediate promptly through supported kernel updates, but avoid treating this as an internet-wide emergency: the supplied evidence indicates local prerequisites and no known active exploitation.
Technical view
The hw_scan path allocated a buffer smaller than required, allowing an overwrite that could cause memory-management complaints and access-violation faults. Early returns could also omit cleanup, causing memory leaks. The referenced Linux stable commits correct the allocation size and deinitialization flow.
Likely exposure
Exposure is limited to Linux systems running affected 5.17-series or 5.18 code with the rtw88 driver relevant to installed wireless hardware. The supplied version data is ambiguous at patch boundaries, so confirm the distribution kernel and whether it contains either referenced fix commit.
Exploitation context
No active exploitation is established: the source bundle marks this CVE absent from KEV and provides no cited exploitation evidence. CVSS 3.1 rates it 7.8, requiring local access and low privileges, without user interaction. The sources do not establish reliable exploitation beyond crashes, corruption, or leaks.
Researcher notes
The core defect combines undersized allocation in hw_scan with incomplete cleanup on early return. Although CWE-401 identifies memory leakage, the description also documents a buffer overwrite. Exact affected and fixed release boundaries cannot be confidently reconstructed from the supplied version array; use commit inclusion or distribution backport records.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced rtw88 fixes.
- Check Linux distribution advisories for the exact fixed package and backport status.
- Where upgrading is delayed, assess disabling unused affected rtw88 hardware or driver functionality under vendor guidance.
- Restrict local account access until remediation is confirmed.
Validation and detection
- Record the running kernel and distribution package versions on systems using rtw88.
- Confirm whether installed wireless hardware loads or depends on the rtw88 driver.
- Verify the kernel source or vendor changelog includes either referenced stable fix.
- Review kernel logs for memory faults associated with rtw88 hardware scanning.
- Retest wireless scanning and monitor kernel stability after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49231 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ec5da191bfcd5fd22b95459b623694f66c1cc10bCVE reference, Linux
- https://git.kernel.org/stable/c/d95984b5580dcb8b1c0036577c52b609990a1dabCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.