Security readout for executives and security teams
Plain-English summary
CVE-2022-49395 is a Linux kernel out-of-bounds read in the User-Mode Linux LDT setup path. A local low-privileged user may trigger memory disclosure or a crash. The source bundle lists high severity with confidentiality and availability impact, but no evidence of active exploitation.
Executive priority
Treat as a high-priority kernel maintenance issue, especially for multi-user Linux, shared hosting, CI, research, or sandbox environments. It is not currently supported as internet-exploited, but kernel memory exposure and crash potential justify timely patching.
Technical view
The bug is in Linux kernel um LDT setup: syscall_stub_data() was given a byte count where it expected a count of longs, causing a stack out-of-bounds read detected by KASAN. The CVSS vector is local, low complexity, low privileges, no user interaction, with high confidentiality and availability impact.
Likely exposure
Exposure is most likely on systems running affected Linux kernel versions or builds using the User-Mode Linux architecture path. The provided affected data lists multiple stable branches and upstream commits, but it does not identify specific distributions or appliances.
Exploitation context
The CVSS vector indicates local exploitation requiring low privileges. The CVE is not marked in KEV, and the provided sources do not cite public exploitation. No remote attack path is supported by the source bundle.
Researcher notes
The source evidence is kernel-level and commit-focused. Validate branch ancestry carefully because the affected version list includes stable-branch and commit identifiers but no distribution mapping. Do not assume exploitability outside the User-Mode Linux LDT setup path without confirming code reachability.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Check distribution advisories for fixed package versions.
- Prioritize systems allowing local untrusted users or UML workloads.
- Restrict local shell access until patched where feasible.
Validation and detection
- Inventory Linux kernel versions across affected assets.
- Identify systems using User-Mode Linux or custom kernel builds.
- Confirm deployed kernels include one of the referenced stable commits.
- Review vulnerability scanner results against vendor advisory fixed versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49395 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/668ca34a428d6ffc0f99a1a6a9b661a288d4183bCVE reference, Linux
- https://git.kernel.org/stable/c/ef1dc929a1e5fa1b2d842256db9fb8710d3be910CVE reference, Linux
- https://git.kernel.org/stable/c/3549ab4b962cf619e8c55484a0d870a34b3f845fCVE reference, Linux
- https://git.kernel.org/stable/c/9caad70819aef3431abaf73ba5163b55b161aba0CVE reference, Linux
- https://git.kernel.org/stable/c/cf0dabc37446c5ee538ae7b4c467ab0e53fa5463CVE reference, Linux
- https://git.kernel.org/stable/c/10995a382271254bd276627ec74136da4a23c4a6CVE reference, Linux
- https://git.kernel.org/stable/c/24ca648bf5f72ed8878cf09b5d4431935779681eCVE reference, Linux
- https://git.kernel.org/stable/c/91e5ba2af2d729d5126aefd5aa3eadc69b8426e5CVE reference, Linux
- https://git.kernel.org/stable/c/2a4a62a14be1947fa945c5c11ebf67326381a568CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.