Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can leak memory when registering a thermal cooling device fails. On affected systems, repeated triggering could reduce available memory and cause service disruption. The public sources describe availability impact, not data theft or privilege escalation.
Executive priority
Treat as a routine availability patch, not an emergency breach indicator. Prioritize shared Linux systems, appliance-like deployments, and environments where local users can repeatedly exercise kernel device paths.
Technical view
CVE-2022-49468 is a CWE-401 memory leak in thermal/core. If device_register() fails after thermal_cooling_device_setup_sysfs() allocated memory, cleanup did not call thermal_cooling_device_destroy_sysfs(). CVSS 3.1 is 5.5 with local, low-complexity, low-privilege availability impact.
Likely exposure
Exposure is limited to Linux kernels identified as affected by the CVE record and code paths registering thermal cooling devices. Risk is higher on systems where local users or drivers can repeatedly hit the failure path.
Exploitation context
The provided sources do not show active exploitation, public weaponization, or KEV listing. The CVSS vector requires local access and low privileges, with impact limited to availability through memory exhaustion.
Researcher notes
Evidence points to a missing cleanup call on the device_register() error path. The source bundle names stable kernel commits but does not provide exploit reports, distro-specific package states, or operational mitigations beyond applying fixed kernels.
Mitigation direction
- Check distribution kernel advisories for CVE-2022-49468 coverage.
- Update affected Linux kernels to builds containing the referenced stable fixes.
- Prioritize systems with local multi-user access or relevant thermal device drivers.
- Monitor affected hosts for abnormal kernel memory growth or availability degradation.
Validation and detection
- Inventory running Linux kernel versions across exposed assets.
- Compare kernel packages against vendor advisories and referenced stable commits.
- Confirm thermal/core fix presence in downstream kernel changelogs.
- Run regression testing for thermal device registration failure handling where applicable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49468 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/18530bedd221160823f63ccc20dd55c7a03edbcfCVE reference, Linux
- https://git.kernel.org/stable/c/21ccc58b671aea924f2481cf5c1cf0ebbfd3552dCVE reference, Linux
- https://git.kernel.org/stable/c/3802171f0b5b8b831f4ade5c827547cb323a5bb2CVE reference, Linux
- https://git.kernel.org/stable/c/9abdf0c0184230f0cb5c6685aabf33dda89aa9fbCVE reference, Linux
- https://git.kernel.org/stable/c/98a160e898c0f4a979af9de3ab48b4b1d42d1dbbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.