Security readout for executives and security teams
Plain-English summary
CVE-2022-49505 is a Linux kernel NFC use-after-free bug. A local, low-privileged user could trigger unsafe kernel memory access, with CVSS impact rated high for confidentiality, integrity, and availability. The provided sources show kernel stable fixes, but no evidence of known active exploitation.
Executive priority
Prioritize routine-to-urgent kernel patching, especially on shared Linux servers and workstations. The issue is high severity but requires local privileges, and the provided evidence does not show active exploitation. Business urgency rises where untrusted users can run code locally.
Technical view
The flaw is CWE-416 in Linux NFC rfkill handling. After NFC device unregister logic, dev->rfkill could still be dereferenced in nfc_dev_up(), producing a KASAN use-after-free through rfkill_blocked(). The fix direction is to NULL dev->rfkill after unregister so later paths do not use freed memory.
Likely exposure
Exposure is limited to Linux systems with affected kernel versions and reachable NFC generic netlink functionality. CVSS indicates local attack, low complexity, low privileges, and no user interaction. Systems without NFC support or without affected kernels are less likely exposed, but source evidence does not provide distro-specific package status.
Exploitation context
The source bundle includes a fuzzing crash trace on Linux 5.18-rc2. CISA KEV status is false, and no cited source states active exploitation. Treat this as a local privilege-risk kernel memory safety issue, not a confirmed in-the-wild campaign.
Researcher notes
Focus analysis on NFC unregister and nfc_dev_up() rfkill lifetime handling. The source crash path shows generic netlink reaching rfkill_blocked() after rfkill free. Evidence supports a use-after-free fix, but not exploitability details beyond CVSS impact assumptions.
Mitigation direction
- Update to a vendor kernel containing the referenced Linux stable fixes.
- Prioritize systems allowing local shell access by non-admin users.
- Check Linux distribution advisories for backported package versions.
- If patching is delayed, review vendor guidance for disabling unused NFC support.
- Track affected kernel branches against the listed stable commit references.
Validation and detection
- Inventory running kernel versions across Linux assets.
- Confirm whether NFC support is enabled or loaded on those systems.
- Compare kernels against vendor advisories and referenced stable fixes.
- Verify patched systems no longer match affected kernel package versions.
- Review local user exposure on multi-user or shared Linux hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49505 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a8e03bcad52dc9afabf650fdbad84f739cec9efaCVE reference, Linux
- https://git.kernel.org/stable/c/f81270125b50532624400063281e6611ecd61ddfCVE reference, Linux
- https://git.kernel.org/stable/c/6abfaca8711803d0d7cc8c0fac1070a88509d463CVE reference, Linux
- https://git.kernel.org/stable/c/fbf9c4c714d3cdeb98b6a18e4d057f931cad1d81CVE reference, Linux
- https://git.kernel.org/stable/c/2a1b5110c95e4d49c8c3906270dfcde680a5a7beCVE reference, Linux
- https://git.kernel.org/stable/c/1632be63862f183cd5cf1cc094e698e6ec005dfdCVE reference, Linux
- https://git.kernel.org/stable/c/4a68938f43b7c2663e4c90bb9bbe29ac8b9a42a0CVE reference, Linux
- https://git.kernel.org/stable/c/4f5d71930f41be78557f9714393179025baacd65CVE reference, Linux
- https://git.kernel.org/stable/c/1b0e81416a24d6e9b8c2341e22e8bf48f8b8bfc9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.