Security readout for executives and security teams
Plain-English summary
A Linux kernel regulator driver can read memory out of bounds when it handles an invalid device-tree setup for the DA9121 device. The reported impact is availability: a local user with privileges could trigger a kernel fault or denial of service. The provided sources do not show active exploitation.
Executive priority
Treat as a targeted kernel availability risk, not a broad remote compromise. Prioritize patching embedded, appliance, or custom-hardware Linux deployments where device-tree inputs and regulator drivers are relevant.
Technical view
CVE-2022-49507 is an uninitialized-value flaw in da9121_assign_chip_model(). With an invalid DTS, chip->subvariant_id can become -EINVAL, after which the driver accesses an uninitialized regmap path during probe, producing a KASAN slab-out-of-bounds report. The kernel fix returns -EINVAL when subvariant_id is invalid.
Likely exposure
Exposure is most plausible on Linux systems using affected kernel versions with the DA9121 regulator driver and relevant I2C/device-tree configuration paths. General servers without this hardware, driver path, or mutable device-tree inputs are less likely to be exposed, but kernel package provenance should be verified.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, and high availability impact. KEV is false in the bundle, and no cited source reports active exploitation. The trigger described is an invalid DTS during device probe, not a remote network condition.
Researcher notes
The evidence is limited to the CVE record and Linux stable commits. The affected-version data in the bundle is not a clean vendor matrix, so rely on kernel or distribution advisories for exact fixed releases. Do not assume confidentiality or integrity impact from these sources.
Mitigation direction
- Update to a kernel containing the referenced stable fixes or a distro backport.
- Check your Linux vendor advisory for the patched package version.
- Restrict device-tree, overlay, and boot-configuration changes to trusted administrators.
- Prioritize systems using the DA9121 regulator driver or custom hardware images.
Validation and detection
- Inventory kernel versions and compare them with vendor fixed builds.
- Check whether the DA9121 regulator driver is built or loaded.
- Review device-tree overlay and hardware configuration management paths.
- Confirm patch presence by mapping your kernel package to the referenced stable commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49507 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/be96baa0c79588084e0d7a4fa21c574cec9a57f4CVE reference, Linux
- https://git.kernel.org/stable/c/7da64c7c82c9b29b628a62c88a8c2fb06990563dCVE reference, Linux
- https://git.kernel.org/stable/c/60f21eda69f1b5727a97d2077da766eb27fcc21fCVE reference, Linux
- https://git.kernel.org/stable/c/bab76514aca36bc513224525d5598da676938218CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.