Security readout for executives and security teams
Plain-English summary
CVE-2022-49375 is a Linux kernel bug in the MediaTek MT6397 RTC driver. If a required hardware resource lookup fails, the kernel may dereference a NULL pointer and crash. The main business risk is local denial of service on affected systems, not data theft or privilege escalation based on the provided sources.
Executive priority
Treat as a moderate-priority availability issue. Patch through normal kernel maintenance, with faster handling for devices where local users, tenants, or apps could trigger kernel crashes.
Technical view
The rtc-mt6397 driver did not check whether platform_get_resource() returned NULL before use. The resolved change adds return-value validation to prevent a NULL pointer dereference. CVSS 3.1 is 5.5, local attack vector, low complexity, low privileges required, no user interaction, and high availability impact only.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel builds with the MT6397 RTC driver relevant to their hardware. This is more plausible in embedded, mobile, or MediaTek-based environments than in generic server fleets.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation. The CVSS vector requires local access with low privileges. Impact is described as availability loss through a kernel NULL pointer dereference.
Researcher notes
Evidence is narrow but consistent: the CVE record describes a missing NULL check after platform_get_resource(). The provided references are Linux stable commits. No source in the bundle claims remote exploitation, confidentiality impact, integrity impact, or public weaponization.
Mitigation direction
- Apply Linux stable or distribution kernel updates containing the referenced fix.
- Check vendor or distribution advisories for exact fixed package versions.
- Prioritize MediaTek MT6397-based embedded or device fleets.
- If updates are unavailable, request vendor mitigation guidance.
- Avoid assuming a generic configuration workaround without vendor confirmation.
Validation and detection
- Inventory systems for affected Linux kernel versions and MT6397 RTC driver use.
- Confirm whether vendor kernels include one of the referenced stable fixes or backports.
- Review crash telemetry for NULL pointer dereferences in the mt6397 RTC path.
- Verify patched systems no longer carry the vulnerable driver logic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49375 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3867f0bbb94773d41e789257abec0d14f37da217CVE reference, Linux
- https://git.kernel.org/stable/c/79fa3f5758d8712df0678df98161f948fc4370e5CVE reference, Linux
- https://git.kernel.org/stable/c/6ecd4d5c28408df36a1a6f0b1973f633c949ac1fCVE reference, Linux
- https://git.kernel.org/stable/c/d77f28c1bc9d3043a52069fe42e4a26fbf961ebdCVE reference, Linux
- https://git.kernel.org/stable/c/82bfea344e8f7e9a0e0b1bf9af27552baa756620CVE reference, Linux
- https://git.kernel.org/stable/c/865051de2d9eaa50630e055b73921ceaf3c4a7fcCVE reference, Linux
- https://git.kernel.org/stable/c/58a729c55ce3a432eb827fdaa24c7909cd3b0a6bCVE reference, Linux
- https://git.kernel.org/stable/c/da38e86d6cf6dd3bc65c602d998f357145aa1a0bCVE reference, Linux
- https://git.kernel.org/stable/c/d3b43eb505bffb8e4cdf6800c15660c001553fe6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.