Security readout for executives and security teams
Plain-English summary
CVE-2022-49482 is a Linux kernel reliability issue in the mxs-saif audio driver. A reference-counted device-tree node was not released correctly during driver probing. The published impact is local denial of service, not data theft or privilege escalation.
Executive priority
Treat as routine but real patching work. It is a medium-severity local availability issue with no provided evidence of active exploitation. Prioritize exposed multi-user or embedded Linux systems, then handle through normal kernel maintenance cycles.
Technical view
The Linux kernel mxs_saif_probe path calls of_parse_phandle(), which returns a node with an incremented refcount. The fix adds of_node_put() when done, preventing a refcount leak. CVSS 3.1 is 5.5 with local, low-complexity, low-privilege attack conditions and high availability impact.
Likely exposure
Exposure appears limited to Linux systems using affected kernel versions with the mxs-saif ASoC driver path present. The source bundle does not prove broad server exposure. Asset owners should map kernel versions and vendor backports rather than relying only on upstream version strings.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source reports active exploitation. The CVSS vector requires local access and low privileges, with availability impact only. Evidence for real-world exploitation is incomplete.
Researcher notes
The root issue is a missing of_node_put() after of_parse_phandle() in mxs_saif_probe. The source bundle gives upstream stable commit references but not complete distribution fix mapping, affected configuration requirements, or exploit proof.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced upstream stable fix.
- Check Linux distribution advisories for the correct backported package version.
- Prioritize systems where local users or workloads can reach the affected driver path.
- Avoid direct wrangler or deployment assumptions; follow normal change control for kernel updates.
Validation and detection
- Inventory Linux kernel versions and vendor package builds across affected assets.
- Confirm whether the mxs-saif driver is built, loaded, or relevant to deployed hardware.
- Verify the vendor kernel includes the upstream stable commit or equivalent backport.
- Retest affected systems after patching for normal audio and boot behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49482 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c933829cbf3338b684869e6c4c8931abf5d68fbdCVE reference, Linux
- https://git.kernel.org/stable/c/d42601e93fce7802bb8d70dd59b60cfeefa20469CVE reference, Linux
- https://git.kernel.org/stable/c/30d110ca703ce60162ec337aa564a3e4da30715fCVE reference, Linux
- https://git.kernel.org/stable/c/18b907ff0ae4bf20120aae1538f7156b9d08e3a7CVE reference, Linux
- https://git.kernel.org/stable/c/2a0da7641e1f17a744ac7b3f76471388c97b63dcCVE reference, Linux
- https://git.kernel.org/stable/c/24491124406666bf0dcb9ee10c5575c6ce6a1730CVE reference, Linux
- https://git.kernel.org/stable/c/4e2a1bcc51bdebed48176f6e88c150f175983f9cCVE reference, Linux
- https://git.kernel.org/stable/c/d855505851ee8ba666eb204149b49f906130dc17CVE reference, Linux
- https://git.kernel.org/stable/c/2be84f73785fa9ed6443e3c5b158730266f1c2eeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.