Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability issue in the PowerPC fsl_rio code path. A missing cleanup call can leak a device-tree reference. The CVSS score is medium, and the recorded impact is denial of service, not data theft or privilege escalation.
Executive priority
Handle through normal kernel maintenance unless affected PowerPC or embedded systems support critical operations. Raise priority where local users can access systems and downtime would materially affect service delivery.
Technical view
In fsl_rio_setup, of_parse_phandle returns a node pointer with an incremented reference count. The fix adds of_node_put when the node is no longer needed. The CVSS vector is local, low complexity, low privileges, no user interaction, unchanged scope, and high availability impact.
Likely exposure
Likely exposure is limited to Linux systems running affected kernel versions where the powerpc/fsl_rio code is present and relevant. The bundle lists Linux kernel versions and stable commits, but does not identify specific distributions, appliances, or cloud images.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. Exploitation is scored as local and requiring low privileges. The available evidence supports availability risk only; it does not support confidentiality or integrity impact.
Researcher notes
Evidence is narrow: the vulnerability description identifies a refcount leak and the fix pattern, but not real-world exploit reports, affected distributions, or operational triggers. Treat exposure analysis as configuration-dependent.
Mitigation direction
- Update to a Linux kernel release containing the referenced stable fixes.
- Check your Linux distribution or appliance vendor advisory for backported fixes.
- Prioritize PowerPC systems or platforms using fsl_rio-related kernel functionality.
- Restrict unnecessary local user access on potentially affected systems.
Validation and detection
- Inventory Linux kernel versions across PowerPC and embedded systems.
- Check whether vendor kernels include the referenced stable fix commits.
- Confirm whether fsl_rio-related kernel code is built or deployed.
- Track remediation through normal kernel package or firmware update records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49439 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/51e25fbf20c9152d84a34b7afac15a41fe5c9116CVE reference, Linux
- https://git.kernel.org/stable/c/5b8aa2ba38c010f47c965dd9bb5a8561813ed649CVE reference, Linux
- https://git.kernel.org/stable/c/bcb6c4c5eb4836a21411dfe8247bf9951eb6e7c3CVE reference, Linux
- https://git.kernel.org/stable/c/46fd994763cf6884b88a2da712af918f3ed54d7bCVE reference, Linux
- https://git.kernel.org/stable/c/7b668a59ddfb32727e39b06fdf52b28e58c684e0CVE reference, Linux
- https://git.kernel.org/stable/c/c70dd353d37158e06bf8d450d4b31a7091609924CVE reference, Linux
- https://git.kernel.org/stable/c/5607a77a365df8c0fd5ff43ac424812b95775527CVE reference, Linux
- https://git.kernel.org/stable/c/fcee96924ba1596ca80a6770b2567ca546f9a482CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.