LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49528: media: i2c: dw9714: Disable the regulator when the driver fails to probe

In the Linux kernel, the following vulnerability has been resolved: media: i2c: dw9714: Disable the regulator when the driver fails to probe When the driver fails to probe, we will get the following splat: [ 59.305988] ------------[ cut here ]------------ [ 59.306417] WARNING: CPU: 2 PID: 395 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0 [ 59.310345] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 59.318362] Call Trace: [ 59.318582] <TASK> [ 59.318765] regulator_put+0x1f/0x30 [ 59.319058] devres_release_group+0x319/0x3d0 [ 59.319420] i2c_device_probe+0x766/0x940 Fix this by disabling the regulator in error handling.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the DW9714 camera lens driver. If the driver fails during startup, it may leave a regulator enabled and trigger kernel warnings. The public record does not describe remote attackability, privilege escalation, or active exploitation. Business urgency is mainly for Linux-based devices that include this specific camera hardware or driver path.

Executive priority

Treat as low priority unless you operate Linux devices with this camera driver. Patch during normal maintenance for affected device fleets. Escalate only if vendor guidance identifies broader impact for your product line.

Technical view

CVE-2022-49528 is a Linux kernel fix for drivers/media/i2c/dw9714. During probe failure, error handling did not disable the regulator before resources were released, causing a regulator core warning. The fix adds regulator disable handling on probe error. Public data lists affected Linux versions and stable commits, but no CVSS, CWE, or exploit details.

Likely exposure

Exposure appears limited to Linux systems using the DW9714 media I2C driver, typically embedded or device platforms with matching camera/lens hardware. General servers are unlikely to be exposed unless this driver is built and used.

Exploitation context

No active exploitation is reported in the provided sources, and the CVE is not in KEV. The described condition occurs when the driver fails to probe. Public sources do not establish a practical attacker-controlled path or security impact beyond kernel warning/resource-state mishandling.

Researcher notes

Evidence is narrow: the CVE text documents a probe-failure cleanup bug and two Linux stable commits. No CVSS, CWE, exploitability analysis, or attacker prerequisites are provided. Avoid assuming remote impact without additional vendor or kernel maintainer evidence.

Mitigation direction

  • Update to a Linux kernel package containing the referenced stable fixes.
  • Check your Linux distribution or device vendor advisory for supported patched versions.
  • Prioritize affected embedded, mobile, or camera-enabled Linux devices using DW9714.
  • If unsupported, ask the vendor for a backport or maintenance kernel.

Validation and detection

  • Inventory Linux kernel versions across relevant devices.
  • Determine whether the DW9714 driver is built, loaded, or used.
  • Review vendor kernel changelogs for the referenced fix commits.
  • Check kernel logs for DW9714 probe failure and regulator warnings.
  • Confirm the deployed kernel includes the stable fix or vendor backport.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49528 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcc95d3423c6786d61e3c52898ed69955077f41a6, cc95d3423c6786d61e3c52898ed69955077f41a6unaffected
LinuxLinux4.13, 0, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.