Security readout for executives and security teams
Plain-English summary
CVE-2022-49354 is a Linux kernel resource-management bug in the pata_octeon_cf storage driver. A missing reference release can leak kernel resources during device probing, potentially causing availability impact. The score is medium, and the source bundle shows local, low-privilege attack characteristics, not remote code execution.
Executive priority
Treat as a moderate availability risk. It should enter normal kernel patch management, with higher priority for systems that rely on the affected storage driver or embedded hardware platforms. There is no source evidence of active exploitation or remote compromise.
Technical view
The resolved issue is a missing put_device() after of_find_device_by_node() in octeon_cf_probe. Because of_find_device_by_node() takes a reference, failure to release it creates a refcount leak. CVSS 3.1 is 5.5 with local access, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions where the pata_octeon_cf driver is present and relevant device probing can occur. The bundle lists Linux as affected across several kernel lines and provides stable kernel fix commits. It does not identify specific distributions or appliances.
Exploitation context
The bundle does not indicate active exploitation, and KEV status is false. The CVSS vector requires local access and low privileges. Available evidence supports an availability-focused risk from a kernel refcount leak, not confidentiality or integrity compromise.
Researcher notes
The key evidence is narrow: upstream describes a refcount leak in octeon_cf_probe and stable commits fixing it. The source bundle lacks CWE mapping, exploit discussion, distribution advisories, and operational mitigations beyond applying fixed kernels or vendor guidance.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fix.
- Confirm distribution backports rather than relying only on upstream version numbers.
- Review vendor advisories for interim mitigation if immediate patching is not possible.
- Prioritize systems using Octeon CF or related ATA driver functionality.
Validation and detection
- Inventory Linux kernel versions across exposed servers and appliances.
- Check whether pata_octeon_cf is built, loadable, or present in the kernel package.
- Verify the kernel source or changelog includes the missing put_device() fix.
- Map vendor kernel builds to upstream stable commits or advisories.
- Record exceptions where the affected driver is absent or unreachable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49354 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7bd85c5ba1687daf54e3b6907673c3604b1e75cfCVE reference, Linux
- https://git.kernel.org/stable/c/a4d3e5f1d7d4f8b5e3834fec0f057a762c55806bCVE reference, Linux
- https://git.kernel.org/stable/c/8d8ad067b90f231b8fdb14acee673ca4012f6045CVE reference, Linux
- https://git.kernel.org/stable/c/d5a1e7f33c88780b279835d63665d7e38ccb671fCVE reference, Linux
- https://git.kernel.org/stable/c/19cb3ece14547cb1ca2021798aaf49a3f82643d1CVE reference, Linux
- https://git.kernel.org/stable/c/888312dc297a8a103f6371ef668c7e04f57a7679CVE reference, Linux
- https://git.kernel.org/stable/c/c9782e1b21bee4b783a64b2a91e7e71406c21a21CVE reference, Linux
- https://git.kernel.org/stable/c/fb2cb409b504bb3a69e65a17f3120328c8e50219CVE reference, Linux
- https://git.kernel.org/stable/c/10d6bdf532902be1d8aa5900b3c03c5671612aa2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.