Security readout for executives and security teams
Plain-English summary
CVE-2022-49382 is a Linux kernel issue in Rockchip SoC support where a device-tree node reference is not released. The reported business impact is availability: a local low-privileged user could contribute to denial of service on affected systems. The sources do not show data theft, integrity impact, or active exploitation.
Executive priority
Treat as a routine but real availability-risk kernel maintenance item. It does not justify emergency response based on the provided evidence, but affected operational devices should be patched through normal vulnerability management because local denial of service can still disrupt services.
Technical view
In rockchip_grf_init, of_find_matching_node_and_match returns a node pointer with an incremented refcount. The fix adds the missing of_node_put() when processing is complete. CVSS 3.1 is 5.5 with local attack vector, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most relevant to Linux systems using affected kernel versions with Rockchip SoC GRF code. The source bundle lists Linux as the affected product but does not enumerate distributions, appliances, or device models, so asset mapping requires kernel and vendor-package validation.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. The CVSS vector indicates local, low-privileged exploitation with availability impact only. No public exploit details are included in the provided sources.
Researcher notes
No CWE is listed. The evidence describes a reference-count leak, not memory corruption or privilege escalation. The affected-version data is broad and partly noisy, so confirm exact exposure through upstream stable commits and downstream vendor backports.
Mitigation direction
- Upgrade to a supported kernel containing the referenced stable fix or an equivalent vendor backport.
- Check distribution or device-vendor advisories before assuming a package is fixed.
- Prioritize internet-facing or operationally critical Rockchip-based systems for maintenance windows.
- Reboot into the fixed kernel after applying kernel updates, if required by vendor guidance.
Validation and detection
- Inventory Linux kernel versions on Rockchip-based assets.
- Confirm whether vendor kernel packages include one of the referenced stable commits or equivalent backport.
- Review fleet exposure for affected Linux versions listed in the CVE bundle.
- After update, verify systems boot the intended fixed kernel and remain stable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49382 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d5422f323858cad3ac3581075f9a3a5e0d41c0d8CVE reference, Linux
- https://git.kernel.org/stable/c/28133325526b92921f3269fdf97a20d90b92b217CVE reference, Linux
- https://git.kernel.org/stable/c/69a30b2ed620c2206cbbd1e9c112e4fc584e02bdCVE reference, Linux
- https://git.kernel.org/stable/c/5b3e990f85eb034faa461e691e719e8ce9e2a3c8CVE reference, Linux
- https://git.kernel.org/stable/c/aab25b669cb9fd3698c2631be4435f4fe92d9e59CVE reference, Linux
- https://git.kernel.org/stable/c/042571fe1d171773655ad706715ecc865913d9a4CVE reference, Linux
- https://git.kernel.org/stable/c/8f64e84924604bb969ee1fbc4b8d7d09b9214889CVE reference, Linux
- https://git.kernel.org/stable/c/9b59588d8be91c96bfb0371e912ceb4f16315dbfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.