Security readout for executives and security teams
Plain-English summary
CVE-2022-49514 is a Linux kernel availability issue in a MediaTek audio driver error path. A missing reference release can leak kernel object references when probing fails. The published score is medium, but the impact is availability-only and requires local low-privileged access.
Executive priority
Treat this as a moderate Linux platform maintenance issue, not an emergency. Prioritize patching affected endpoint, embedded, or appliance kernels where local users or workloads are not fully trusted.
Technical view
The resolved defect is in ASoC mediatek mt8173_max98090_dev_probe. On an error path, platform_node was not released with of_node_put(platform_node), causing a device-tree node refcount leak. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the relevant MediaTek MT8173/MAX98090 ASoC driver path present. The bundle lists Linux kernel versions and stable commit references, but does not identify specific distributions, devices, or cloud images.
Exploitation context
No source in the bundle states active exploitation, and KEV is false. The CVSS vector indicates local, low-privileged conditions with no user interaction and no confidentiality or integrity impact. Evidence for real-world exploitability is incomplete in the provided sources.
Researcher notes
The key evidence is narrow: a kernel refcount leak fix in a specific MediaTek ASoC probe error path. The bundle does not provide proof-of-concept details, exploitation reports, affected distribution mappings, or operational mitigations beyond applying fixed kernel code.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Check Linux distribution or device vendor advisories for backported fixes.
- Prioritize systems using MediaTek MT8173/MAX98090 audio support.
- Track kernel package status against the listed affected versions.
- If unpatched, reduce untrusted local access where feasible.
Validation and detection
- Inventory running kernel versions on relevant Linux assets.
- Confirm whether the MediaTek MT8173/MAX98090 ASoC driver is present or enabled.
- Verify the vendor kernel includes the referenced of_node_put error-path fix.
- Review distribution changelogs for CVE-2022-49514 backport coverage.
- Document assets that cannot be patched immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49514 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0a1901f34f775b83ea4b8dbb5ed992147b9b8531CVE reference, Linux
- https://git.kernel.org/stable/c/1e932aba3c7628c9f880ee9c2cfcc2ae3ba0c01eCVE reference, Linux
- https://git.kernel.org/stable/c/cc43b9fdca519c5b13be6a717bacbebccd628cf6CVE reference, Linux
- https://git.kernel.org/stable/c/23f340ed906c758cec6527376768e3bc1474ac30CVE reference, Linux
- https://git.kernel.org/stable/c/fb66e0512e5ccc093070e21cf88cce8d98c181b5CVE reference, Linux
- https://git.kernel.org/stable/c/48889eb3cce91d7f58e02bc07277b7f724b7a54aCVE reference, Linux
- https://git.kernel.org/stable/c/ebd5cb4f1f3f10b839e7575219e0f17b60c23113CVE reference, Linux
- https://git.kernel.org/stable/c/98d5afe868df998b0244f4c229ab758b4083684aCVE reference, Linux
- https://git.kernel.org/stable/c/4f4e0454e226de3bf4efd7e7924d1edc571c52d5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.