Security readout for executives and security teams
Plain-English summary
CVE-2022-49492 is a Linux kernel crash bug in NVMe PCI storage handling. If queue setup fails, later cleanup may treat an error value as a real queue and dereference it. The documented impact is availability loss, not data theft or tampering.
Executive priority
Treat as a moderate availability risk. It is unlikely to justify emergency action by itself, but production Linux systems with NVMe storage should receive normal kernel patching priority, especially where local users or workloads are not fully trusted.
Technical view
The flaw is a CWE-476 NULL pointer dereference in nvme_alloc_admin_tags error handling. When blk_mq_init_queue fails, admin_q can hold an error value. The reset/remove path reaches nvme_suspend_queue for queue 0 and only checks non-NULL, causing invalid queue quiescing and a kernel crash.
Likely exposure
Exposure is most relevant to Linux systems using NVMe PCI storage on affected kernel branches. The CVE record lists Linux as affected and names kernel versions including 3.19 through 5.19, but distribution backports may change practical exposure.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. KEV is false, and the provided sources do not state active exploitation or public exploit availability.
Researcher notes
The key condition is failed admin queue allocation followed by cleanup that checks only non-NULL instead of excluding error pointers. Evidence supports denial of service through kernel crash; it does not support confidentiality, integrity, remote exploitation, or active exploitation claims.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable nvme-pci fix.
- Prioritize systems with NVMe PCI storage and shared multi-user access.
- Check Linux distribution advisories for backported fixes before relying on upstream version numbers.
- Limit unnecessary local shell access on systems awaiting kernel updates.
Validation and detection
- Inventory kernel versions across Linux hosts using NVMe PCI storage.
- Compare installed kernels against vendor advisories and the referenced stable commits.
- Review crash logs for nvme_alloc_admin_tags, nvme_suspend_queue, or NULL pointer dereference indicators.
- Confirm patched kernels are deployed and booted, not only installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49492 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8321b17789f614414206af07e17ce4751c95dc76CVE reference, Linux
- https://git.kernel.org/stable/c/9e649471b396fa0139d53919354ce1eace9b9a24CVE reference, Linux
- https://git.kernel.org/stable/c/8da2b7bdb47e94bbc4062a3978c708926bcb022cCVE reference, Linux
- https://git.kernel.org/stable/c/f76729662650cd7bc8f8194e057af381370349a7CVE reference, Linux
- https://git.kernel.org/stable/c/af98940dd33c9f9e1beb4f71c0a39260100e2a65CVE reference, Linux
- https://git.kernel.org/stable/c/906c81dba8ee8057523859b5e1a2479e9fd34860CVE reference, Linux
- https://git.kernel.org/stable/c/7a28556082d1fbcbc599baf1c24252dfc73efefcCVE reference, Linux
- https://git.kernel.org/stable/c/54a4c1e47d1b2585e74920399455bd9abbfb2bd7CVE reference, Linux
- https://git.kernel.org/stable/c/da42761181627e9bdc37d18368b827948a583929CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.