Security readout for executives and security teams
Plain-English summary
CVE-2022-49729 is a Linux kernel memory leak in the Marvell NFC driver. A local, low-privileged attacker could potentially trigger resource exhaustion, causing availability impact. The source bundle does not show data theft, integrity loss, remote reachability, or active exploitation evidence.
Executive priority
Treat as a moderate availability risk. It is not supported as remotely exploitable or actively exploited in the provided evidence, but systems using affected NFC driver paths should be patched through normal kernel maintenance.
Technical view
The flaw is in nfcmrvl_play_deferred. Deferred TX USB URBs were submitted directly after being unanchored, preventing expected unreference handling and leaking memory. Upstream stable commits re-anchor those URBs in tx_anchor and adjust error handling. The CVSS vector is local attack, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with the nfcmrvl Marvell NFC driver present and usable. Systems without this driver, without relevant NFC hardware, or already on kernels containing the stable fixes are less likely exposed.
Exploitation context
The bundle does not identify public exploitation, exploit code, or CISA KEV listing. The scored scenario requires local access with low privileges and targets availability through memory leakage, not confidentiality or integrity.
Researcher notes
The evidence is kernel-resolution text and stable commit references. The affected-version data is broad and partly commit-oriented, so validate exposure through kernel package lineage and driver configuration rather than version strings alone.
Mitigation direction
- Apply vendor kernel updates that include the referenced upstream stable fixes.
- Prioritize systems with NFC hardware or nfcmrvl driver enabled.
- If patching is delayed, check vendor guidance for safe NFC or driver reduction.
- Track distribution advisories for the exact fixed package versions.
Validation and detection
- Inventory Linux kernel versions across affected assets.
- Check whether the nfcmrvl driver is built, loaded, or used.
- Map kernel packages against vendor advisories and upstream fix commits.
- Confirm updated systems run kernels containing the referenced stable fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49729 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1eb0afecfb9cd0f38424b82bd9aaa542310934eeCVE reference, Linux
- https://git.kernel.org/stable/c/f21f908347712b8288ffe83b531b5e977042b29cCVE reference, Linux
- https://git.kernel.org/stable/c/3e7c7df6991ac349f2fa8540047757df666e610fCVE reference, Linux
- https://git.kernel.org/stable/c/6b4d8b44e7163a77fe942f5b80e1651c1b78c537CVE reference, Linux
- https://git.kernel.org/stable/c/0eeec1a8b0cd38c47edeb042980a6aeacecf35edCVE reference, Linux
- https://git.kernel.org/stable/c/6616872cfe7f0474a22dd1f12699f95bcf81a54dCVE reference, Linux
- https://git.kernel.org/stable/c/3eadc560c1919b8193d17334145dad9a917960e4CVE reference, Linux
- https://git.kernel.org/stable/c/8a4d480702b71184fabcf379b80bf7539716752eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.