Security readout for executives and security teams
Plain-English summary
CVE-2022-49407 is a Linux kernel DLM bug where lock handling can make the kernel read beyond the allocated object. The public record shows KASAN finding a slab-out-of-bounds read in dev_write used by dlm_controld. Business urgency depends on whether Linux cluster locking/DLM is enabled in your estate.
Executive priority
Treat as a targeted kernel maintenance issue, not an internet-wide emergency based on current evidence. Prioritize organizations running Linux clustering or DLM-backed shared storage, because kernel memory safety issues can affect availability and platform trust even when exploitation details are incomplete.
Technical view
The flaw is in Linux kernel DLM plock handling. An unlock allocates struct plock_op, send_op places it on send_list, and later dev_read/dev_write may treat it as struct plock_xop and read fields that are not present. The fix moves callback into struct plock_op to gate plock_xop-specific handling.
Likely exposure
Exposure is most likely on Linux systems using the DLM kernel module and dlm_controld for clustered locking. The bundle lists Linux as affected across multiple kernel lines through 5.19, but does not provide distribution-specific package status or deployed configuration requirements.
Exploitation context
The provided sources show a KASAN-discovered invalid read and mark KEV as false. They do not provide evidence of active exploitation, public exploit availability, remote reachability, privilege requirements, or business impact beyond the kernel out-of-bounds read.
Researcher notes
The record lacks CVSS, CWE, and exploitability analysis. The strongest evidence is the kernel commit narrative and KASAN trace. Researchers should focus on affected DLM plock code paths, vendor backport mapping, and whether local clustered-locking workflows can trigger the invalid read.
Mitigation direction
- Identify Linux systems using DLM or dlm_controld.
- Prioritize cluster nodes and shared-locking infrastructure for review.
- Apply vendor kernel updates containing the referenced stable fixes.
- If patch status is unclear, check distribution security advisories.
- Disable unused DLM functionality where operationally safe.
Validation and detection
- Inventory kernel versions and vendor backport levels.
- Check whether the DLM module is loaded or configured.
- Confirm dlm_controld is installed, enabled, or running.
- Map systems to the referenced fixed stable commits.
- Record exceptions where vendor guidance is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49407 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2c55155cc365861044d9e6e80e342693e8805e33CVE reference, Linux
- https://git.kernel.org/stable/c/72f2f68970f9bdc252d59e119b385a6441b0b155CVE reference, Linux
- https://git.kernel.org/stable/c/5a1765adf9855cf0f6d3f7e0eb4b78ca66f70deeCVE reference, Linux
- https://git.kernel.org/stable/c/49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6dCVE reference, Linux
- https://git.kernel.org/stable/c/899bc4429174861122f0c236588700a4710c1fecCVE reference, Linux
- https://git.kernel.org/stable/c/acdad5bc9827922ec2f2e84fd198718aa8e8ab92CVE reference, Linux
- https://git.kernel.org/stable/c/56aa8d1fbd02357f3bf81bdfba1cde87ce8402fcCVE reference, Linux
- https://git.kernel.org/stable/c/e421872fa17542cf33747071fb141b0130ce9ef7CVE reference, Linux
- https://git.kernel.org/stable/c/42252d0d2aa9b94d168241710a761588b3959019CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.