Security readout for executives and security teams
Plain-English summary
CVE-2022-49389 is a Linux kernel USB/IP bug that can leak a device reference when stub_probe() fails. The practical concern is local availability impact, not data theft. Sources rate it medium severity with high availability impact, low attack complexity, and required local low privileges.
Executive priority
Handle through normal kernel patch management unless USB/IP is important in the environment. There is no cited active exploitation, but the availability impact justifies tracking to closure on affected Linux assets.
Technical view
The flaw is a reference-count leak in Linux usbip stub_probe(). usb_get_dev() is called during stub_device_alloc(), but an error path failed to call usb_put_dev(). Stable commits move usb_put_dev() into sdev_free error handling. The issue was found by code review.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with reachable USB/IP stub code paths. The CVE record names Linux kernel version ranges but does not identify affected distributions, appliances, or cloud images. Validate against vendor kernel packages and the listed upstream stable fixes.
Exploitation context
The source bundle reports local attack vector, low complexity, low privileges, no user interaction, and no confidentiality or integrity impact. It is not in KEV, and no cited source reports active exploitation or public exploit activity.
Researcher notes
Evidence supports a narrow kernel error-path refcount leak with availability impact. The bundle does not provide exploit mechanics, affected distribution mapping, or workaround details. Research should focus on kernel version mapping, USB/IP configuration exposure, and whether vendor backports include the stable commits.
Mitigation direction
- Update affected Linux kernels to vendor releases containing the listed upstream stable fixes.
- Check Linux distribution advisories for package-specific fixed versions.
- Prioritize systems using USB/IP or exposing USB device virtualization workflows.
- If patch timing is unclear, follow vendor guidance for temporary risk reduction.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and embedded systems.
- Compare running kernels with vendor advisories and the upstream stable commit list.
- Identify hosts where USB/IP functionality is enabled or operationally required.
- Confirm updated hosts boot into the fixed kernel, not only install it.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 6bafee2f18af
- Linux stable commit f20d2d3b3364
- Linux stable commit 247d3809e45a
- Linux stable commit 2f0ae93ec33c
- Linux stable commit bcbb795a9e78
- Linux stable commit 51422046be50
- Linux stable commit 8afb04880091
- Linux stable commit 11c65408bd0b
- Linux stable commit 9ec4cbf1cc55
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49389 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6bafee2f18af5e5ac125e42960bc65496d0e56a0CVE reference, Linux
- https://git.kernel.org/stable/c/f20d2d3b3364ce6525c050a8b6b4c54c8c19674dCVE reference, Linux
- https://git.kernel.org/stable/c/247d3809e45a34d9e1a3a2bb7012e31ed8b46031CVE reference, Linux
- https://git.kernel.org/stable/c/2f0ae93ec33c8456cdfbf7876b80403a6318ebceCVE reference, Linux
- https://git.kernel.org/stable/c/bcbb795a9e78180d74c6ab21518da87e803dfdceCVE reference, Linux
- https://git.kernel.org/stable/c/51422046be504515eb5a591adf0f424b62f46804CVE reference, Linux
- https://git.kernel.org/stable/c/8afb048800919d0ab10c57983940eba956339f21CVE reference, Linux
- https://git.kernel.org/stable/c/11c65408bd0ba1d9cd1307caa38169292de9cdfbCVE reference, Linux
- https://git.kernel.org/stable/c/9ec4cbf1cc55d126759051acfe328d489c5d6e60CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.