Security readout for executives and security teams
Plain-English summary
CVE-2022-49397 is a Linux kernel reliability issue in the Qualcomm QMP PHY driver. During certain device probe failures, the driver could keep a clock reference instead of releasing it. The public record does not provide CVSS, CWE, or evidence of active exploitation.
Executive priority
Handle as routine patch management unless the organization operates Qualcomm-based Linux devices where hardware initialization failures affect availability. There is no sourced evidence of active exploitation or a named severe impact.
Technical view
The qcom-qmp PHY driver failed to release the pipe clock reference on late probe errors, including probe deferral. The fix releases that reference on error paths. Sources describe a resource leak, not a direct remote code execution or privilege escalation path.
Likely exposure
Exposure appears limited to Linux systems using the Qualcomm QMP PHY driver and affected kernel versions or backports identified by the CVE record. General Linux servers without this hardware or driver are less likely to be exposed.
Exploitation context
No cited source says this is actively exploited, and the CVE is not marked KEV. The source bundle only supports a probe-error resource leak scenario. Practical impact is most likely operational reliability on affected Qualcomm-based systems.
Researcher notes
Evidence is narrow: the CVE description and Linux stable references identify a missing clock-reference release on probe error paths. The record lacks CVSS, CWE, exploit details, and impact analysis. Avoid expanding affected scope beyond Linux kernels and Qualcomm QMP PHY usage.
Mitigation direction
- Update to a kernel version containing the referenced stable fixes.
- Check distribution, device, or vendor advisories for backported patches.
- Prioritize Qualcomm-based Linux devices using the qcom-qmp PHY driver.
- Track this through normal kernel patch management unless local evidence shows instability.
Validation and detection
- Inventory kernels on Qualcomm-based Linux devices.
- Confirm whether the qcom-qmp PHY driver is present and used.
- Compare deployed kernel builds with the affected versions in the CVE record.
- Verify patched builds include one referenced stable commit or vendor backport.
- Review boot and probe logs for qcom-qmp probe errors if reliability issues exist.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49397 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b999d48b0869b8599de532ff6081575a7ab5358aCVE reference, Linux
- https://git.kernel.org/stable/c/621a4bcfb7aa031e7760d7b156bad7a45df58387CVE reference, Linux
- https://git.kernel.org/stable/c/1668ad103679306ba2ef37f758d704e58a3ef1a0CVE reference, Linux
- https://git.kernel.org/stable/c/6f3673c8d8eff0c4ab5a5ee0d3ca9717d85419b4CVE reference, Linux
- https://git.kernel.org/stable/c/b246695636a861a09f0e2cde92bb2dd8f114f024CVE reference, Linux
- https://git.kernel.org/stable/c/f8d23895a41243c6a8dbf392e531fff9497bb023CVE reference, Linux
- https://git.kernel.org/stable/c/ad9b0fad02f9b3a06ad5ac7df11f244e316a6254CVE reference, Linux
- https://git.kernel.org/stable/c/f0a4bc38a12f5a0cc5ad68670d9480e91e6a94dfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.