Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a memory-lifecycle bug in the CPU frequency governor code. The kernel freed an object directly instead of through the required kobject release path, producing a warning and unsafe cleanup behavior. The public data does not provide a CVSS score, confirmed exploitation, or a complete product matrix.
Executive priority
Treat this as a kernel maintenance and exposure-confirmation item, not an emergency based on current evidence. Escalate priority for shared systems, appliances, or hosts where untrusted users can influence CPU frequency governor settings.
Technical view
The affected code embeds a kobject inside gov_attr_set, which is embedded in dbs_data. Direct kfree() of dbs_data violates kobject lifetime rules. The fix adds cpufreq_dbs_data_release() and moves governor exit handling into the kobject release path, addressing the reported debugobjects call trace during scaling_governor writes.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or downstream builds without the referenced cpufreq governor fix. The bundle identifies Linux kernel impact, but distribution-specific backports and appliance exposure are not established in the provided evidence.
Exploitation context
The source bundle does not report active exploitation, KEV listing, exploit availability, or remote attack details. The call trace shows local sysfs interaction with CPU frequency governor settings, but the evidence is insufficient to claim practical exploitability or impact beyond the described kernel cleanup fault.
Researcher notes
The key issue is kobject ownership and release ordering in cpufreq governor data structures. The source evidence supports an upstream fix but lacks CVSS, CWE, exploit status, and downstream package mapping. Avoid over-scoping beyond Linux kernel builds missing the cited fix.
Mitigation direction
- Update to a vendor kernel that includes the referenced cpufreq governor fix.
- Check Linux distribution advisories for backport status and fixed package versions.
- Prioritize systems where untrusted local users can change CPU frequency governor settings.
- Avoid inventing local workarounds; follow vendor guidance where patching is delayed.
Validation and detection
- Inventory Linux kernel versions and distribution build identifiers across affected systems.
- Confirm whether vendor kernels include the referenced upstream stable commits.
- Review kernel logs for matching debugobjects or cpufreq governor cleanup warnings.
- Verify CPU frequency governor interfaces are not writable by untrusted users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49513 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a1964688582d26af1328e19b658933659fb54337CVE reference, Linux
- https://git.kernel.org/stable/c/1e32083f327184b6226ce320ef30085ce785ea4eCVE reference, Linux
- https://git.kernel.org/stable/c/a85ee6401a47ae3fc64ba506cacb3e7873823c65CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.