Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can let a local user trigger a kernel crash through the virtio GPU display path. It is mainly an availability risk, not a data theft or privilege escalation issue based on the provided CVSS and sources.
Executive priority
Treat as routine but real patch work for affected Linux virtualized systems. It is not supported as actively exploited, but it can affect service availability where local users or workloads can reach the vulnerable graphics path.
Technical view
CVE-2022-49532 is a CWE-476 NULL pointer dereference in drm/virtio, specifically virtio_gpu_conn_get_modes. drm_cvt_mode can return NULL, and the vulnerable code failed to check that return before use. Syzkaller found the crash under allocation-failure fault injection.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with the virtio_gpu DRM driver available or in use, especially virtualized environments using virtio graphics. The CVSS vector requires local privileges.
Exploitation context
The provided sources do not show active exploitation, and KEV is false. The issue was identified by syzkaller testing. Impact is availability: a local privileged-enough user path can cause a kernel NULL pointer dereference and crash.
Researcher notes
The evidence supports a local availability bug in the virtio GPU connector mode enumeration path. The trigger shown relies on allocation failure and DRM ioctl call flow; do not infer remote reachability or confidentiality impact from the provided sources.
Mitigation direction
- Apply Linux distribution kernel updates that include the referenced stable fixes.
- Confirm vendor guidance for the exact fixed kernel package on each distribution.
- Prioritize virtualized Linux hosts or guests using virtio GPU graphics.
- Reduce local untrusted user access on affected systems until patched.
Validation and detection
- Inventory Linux kernel versions against the affected version list in the CVE record.
- Check whether virtio_gpu or DRM virtio graphics is present or used.
- Verify the installed kernel includes the applicable stable fix commit or vendor backport.
- Review crash telemetry for NULL dereferences in virtio_gpu_conn_get_modes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49532 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e0828456578cc8ba0a69147f7ae3428392eec287CVE reference, Linux
- https://git.kernel.org/stable/c/848dd072744ea662ab3097e3c8282bee552df218CVE reference, Linux
- https://git.kernel.org/stable/c/edafcad84c4134ebec4bc24b29ca4497a1184eeaCVE reference, Linux
- https://git.kernel.org/stable/c/f85cb059fad03a3b33a50023be91e944bb065ae8CVE reference, Linux
- https://git.kernel.org/stable/c/fadc626cae99aaa1325094edc6a9e2b883f3e562CVE reference, Linux
- https://git.kernel.org/stable/c/32e10aabc287f09a148ff759bb9ce70b01b0012cCVE reference, Linux
- https://git.kernel.org/stable/c/c51d00472fa54b9b05c17789ed665c17adf3a25dCVE reference, Linux
- https://git.kernel.org/stable/c/0f8bc147a963686b7351aa35d1701124ffacac08CVE reference, Linux
- https://git.kernel.org/stable/c/194d250cdc4a40ccbd179afd522a9e9846957402CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.