Security readout for executives and security teams
Plain-English summary
CVE-2022-49351 is a Linux kernel resource-management bug in the Altera TSE MDIO driver path. A local low-privileged user could potentially cause an availability impact. It is not described as exposing data or changing data. Public sources provided do not show active exploitation.
Executive priority
Treat as a routine but real availability-risk kernel update. Prioritize multi-user Linux hosts, shared compute, and embedded systems using the affected networking driver. This does not currently warrant emergency response absent vendor-specific impact or exploitation evidence.
Technical view
The issue is a missing of_node_put() when breaking from for_each_child_of_node() in altera_tse_mdio_create, causing a device-tree node reference count leak. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5. Kernel stable commits are referenced as the remediation source.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with the Altera TSE MDIO driver path present. The attack vector is local and requires low privileges, so internet-facing exposure alone is not the primary concern.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The practical risk is denial of service or resource exhaustion on affected local systems, not remote compromise.
Researcher notes
The CVE record provides limited affected-version detail and no CWE. Analysis should verify the exact downstream backport status for each distribution. The root cause is a reference-count leak in a device-tree iteration error path within altera_tse_mdio_create.
Mitigation direction
- Check your Linux distribution or kernel vendor advisory for CVE-2022-49351 coverage.
- Update to a kernel build containing the referenced stable fix for this issue.
- Prioritize systems where untrusted local users or workloads can run code.
- If updates are unavailable, ask the vendor for supported mitigations.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded systems.
- Identify systems using Altera TSE networking or the affected kernel driver path.
- Confirm whether the running kernel includes one of the referenced stable commits.
- Track remediation through vendor package versions, not only upstream kernel numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49351 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a013fa884d8738ad8455aa1a843b8c9d80c6c833CVE reference, Linux
- https://git.kernel.org/stable/c/1fd12298a0e0ca23478c715e672ee64c85670584CVE reference, Linux
- https://git.kernel.org/stable/c/5cd0e22fa11f4a21a8c09cc258f20b1474c95801CVE reference, Linux
- https://git.kernel.org/stable/c/8174acbef87b8dd8bf3731eba2a5af1ac857e239CVE reference, Linux
- https://git.kernel.org/stable/c/96bf5ed057df2d157274d4e2079002f9a9404bb8CVE reference, Linux
- https://git.kernel.org/stable/c/e31d9ba169860687dba19bdc8fccbfd34077f655CVE reference, Linux
- https://git.kernel.org/stable/c/803b217f1fb49a2dbb2123acdb45111b9c48b8beCVE reference, Linux
- https://git.kernel.org/stable/c/4f850fe0a32c3f1e19b76996a3b1ca32637a14deCVE reference, Linux
- https://git.kernel.org/stable/c/11ec18b1d8d92b9df307d31950dcba0b3dd7283cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.