Security readout for executives and security teams
Plain-English summary
CVE-2022-49457 is a Linux kernel issue in ARM Versatile platform code. A missing reference release can leak kernel object references and potentially degrade availability. The sources rate it medium and local-only, with no confidentiality or integrity impact stated.
Executive priority
Medium priority. Treat this as kernel hygiene with availability relevance, especially on local-user or shared ARM systems. There is no source-supported evidence of active exploitation or broad remote exposure.
Technical view
In dcscb_init, of_find_compatible_node returns a device_node with an incremented reference count. The fix adds of_node_put to avoid a refcount leak. CVSS 3.1 is 5.5: local access, low privileges, no user interaction, availability impact high.
Likely exposure
Exposure appears limited to affected Linux kernel versions and ARM Versatile-related builds or deployments that execute this code path. The provided sources do not justify expanding scope to unrelated Linux platforms, products, or distributions.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation. The CVSS vector indicates a local, low-privilege availability issue, not a remote network attack.
Researcher notes
Evidence is limited to the CVE record, CVE List data, and Linux stable commit references. No CWE is supplied. Validate exposure by kernel configuration and platform path, and avoid assuming impact outside the listed Linux kernel scope.
Mitigation direction
- Update affected Linux kernels to vendor-supported fixed releases or the referenced stable commits.
- Check Linux distribution advisories for packaged kernel availability and backport status.
- Prioritize systems where untrusted local users can run code.
- Use normal kernel reboot or live-patching processes where applicable.
Validation and detection
- Inventory kernel versions and map them to the affected ranges in the CVE record.
- Confirm whether ARM Versatile platform code is built and reachable.
- Verify the fix includes of_node_put handling in dcscb_init.
- Record distributor backport evidence when version numbers do not visibly change.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49457 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2d7b23db35254b7d46e852967090c64cdccf24daCVE reference, Linux
- https://git.kernel.org/stable/c/bbdfb7d4f036118d36415a2575efa6f5246505aeCVE reference, Linux
- https://git.kernel.org/stable/c/a0fc05cd17617e63fc13ad0c01f3f0afd890d8ecCVE reference, Linux
- https://git.kernel.org/stable/c/fcd1999ba97445a12cc394f5f42ffd9116bf0185CVE reference, Linux
- https://git.kernel.org/stable/c/d146e2a9864ade19914494de3fb520390b415d58CVE reference, Linux
- https://git.kernel.org/stable/c/83c329b980bddbc8c6a3d287d91f2103a4d4a860CVE reference, Linux
- https://git.kernel.org/stable/c/3c6006faed9aba5144b33176d061031a9be66954CVE reference, Linux
- https://git.kernel.org/stable/c/d6de7b181c29cd4578ec139aafb5eac062abbe1bCVE reference, Linux
- https://git.kernel.org/stable/c/23b44f9c649bbef10b45fa33080cd8b4166800aeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.