Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability issue caused by a reference-count leak in the sparcspkr input driver. The CVE rates it medium, with local, low-privileged access required and no confidentiality or integrity impact identified. Business urgency is mainly for systems running affected Linux kernels where this driver is relevant.
Executive priority
Treat this as routine-to-moderate Linux kernel maintenance unless affected high-availability systems rely on vulnerable kernels. It does not indicate remote compromise or data theft in the provided evidence, but unpatched availability flaws can still matter on critical infrastructure.
Technical view
The bug is in bbc_beep_probe: of_find_node_by_path increments a device-tree node reference, but the driver did not release it with of_node_put. The resolved kernel commits add the missing release. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no user interaction, availability high.
Likely exposure
Exposure appears limited to Linux systems with affected kernel versions and the sparcspkr/bbc beep driver code path. The source bundle does not identify specific distributions, appliances, or cloud images, so environment-specific kernel inventory is required.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. CVSS indicates exploitation would require local low-privileged access and would affect availability, not data confidentiality or integrity. No public exploit behavior is described in the provided sources.
Researcher notes
The evidence is concise: a missing of_node_put after of_find_node_by_path caused a reference leak. The affected version data in the bundle is not distribution-specific. Validation should focus on kernel source/package mapping and whether the vulnerable driver path is reachable.
Mitigation direction
- Update affected Linux kernels using vendor or kernel stable guidance.
- Map distribution packages to the referenced upstream stable commits.
- Prioritize systems where the sparcspkr driver is present or loaded.
- Check vendor advisories before applying operational workarounds.
- Monitor CVE updates for distribution-specific fixed package versions.
Validation and detection
- Inventory Linux kernel versions across SPARC and relevant Linux hosts.
- Check whether sparcspkr or related input drivers are built or loaded.
- Confirm deployed kernels include one of the referenced stable fixes.
- Review vendor advisories for package-level fixed versions.
- Track this CVE as availability-impacting, not data-exposure-impacting.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49438 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2f51db16cb740ff90086189a1ef2581eab665591CVE reference, Linux
- https://git.kernel.org/stable/c/f13064b0f2c651a3fbb0749932795c6fd21556a8CVE reference, Linux
- https://git.kernel.org/stable/c/353bc58ac6c782d4dcde9136a91d1f90867938feCVE reference, Linux
- https://git.kernel.org/stable/c/bbc2b0ce6042dd3117827f10ea8cb67e0ab786daCVE reference, Linux
- https://git.kernel.org/stable/c/6e07ccc7d56130f760d23f67a70c45366c07debcCVE reference, Linux
- https://git.kernel.org/stable/c/418b6a3e12f75638abc5673eb76cb32127d0ab13CVE reference, Linux
- https://git.kernel.org/stable/c/73d6f42d8d86648bec2e73d34fe1648cb6d23e08CVE reference, Linux
- https://git.kernel.org/stable/c/1124e39fea0e2fdb4202f95b716cb97cc7de7cc7CVE reference, Linux
- https://git.kernel.org/stable/c/c8994b30d71d64d5dcc9bc0edbfdf367171aa96fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.