Security readout for executives and security teams
Plain-English summary
CVE-2022-49400 is a Linux kernel storage bug that can crash a system during md RAID reshape activity. It affects availability, not data confidentiality or integrity per the supplied CVSS vector. Risk is highest for Linux servers using software RAID where reshape or migration operations may occur.
Executive priority
Treat as a moderate availability risk for storage-bearing Linux servers. Prioritize infrastructure where unexpected reboot or kernel panic would interrupt services, backups, or maintenance windows.
Technical view
The md RAID0 cleanup path set mddev->private to NULL during pers->free. During reshape, mddev is retained and assigned a new personality before the old free path runs. RAID0 then clears the new private pointer, causing later NULL dereference and kernel panic in RAID code.
Likely exposure
Exposure is likely limited to Linux systems using the md software RAID subsystem, especially RAID0 involvement during reshape. The source lists affected Linux kernel versions and stable commit references, but the exact distribution package impact requires vendor mapping.
Exploitation context
The source describes a local, low-privilege availability issue with no user interaction. KEV is false, and the provided sources do not claim active exploitation. The demonstrated impact is kernel panic during RAID reshape/resync behavior.
Researcher notes
Evidence supports CWE-476 NULL pointer dereference in Linux md RAID reshape handling. The fix removes RAID0 code that clears mddev->private. Distribution-specific affected ranges and patch status are not fully established by the supplied bundle.
Mitigation direction
- Apply vendor kernel updates that include the referenced stable fixes.
- Check distribution advisories for backported fixes before relying on version numbers alone.
- Prioritize patching Linux hosts that use md software RAID.
- Avoid nonessential md RAID reshape operations until patched, if operationally feasible.
Validation and detection
- Inventory Linux systems using md software RAID.
- Map running kernel packages to vendor advisories and stable fix commits.
- Review storage incident logs for kernel panic patterns in md or RAID modules.
- Confirm patched kernels include the RAID0 private-pointer fix.
- Test planned RAID reshape workflows in staging after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49400 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f63fd1e0e0fc158023cc67ea6a07e278019061baCVE reference, Linux
- https://git.kernel.org/stable/c/b7a51df785031cc49caf1c59766ca89cfa97b54bCVE reference, Linux
- https://git.kernel.org/stable/c/7da3454a65f8a56e65dfb44fa0ccac08cbc2f5a1CVE reference, Linux
- https://git.kernel.org/stable/c/0f2571ad7a30ff6b33cde142439f9378669f8b4fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.