Analyst readout for executives and security teams
Plain-English summary
This is a Linux kernel denial-of-service issue in SAS SCSI transport handling. Under a failed device-add path, later cleanup can dereference a NULL pointer and crash the kernel. The business risk is service interruption on affected Linux systems, especially storage or server platforms using SAS hardware.
Executive priority
Treat as a moderate availability risk. Prioritize patching storage-heavy Linux servers and appliances where an unexpected kernel crash could interrupt business services. There is no supplied evidence of active exploitation, so emergency action is not supported by the provided sources.
Technical view
CVE-2022-49839 is a CWE-476 NULL pointer dereference in scsi_transport_sas sas_phy_add(). If transport_add_device() fails, sas_remove_host() can call transport_remove_device() and crash in device_del(). CVSS 3.1 is 5.5, local attack vector, low complexity, low privileges, no confidentiality or integrity impact, high availability impact.
Likely exposure
Exposure is likely limited to affected Linux kernel builds with SCSI SAS transport code, particularly systems using SAS storage controllers or related kernel modules. The source bundle lists Linux kernel versions including 2.6.14, 5.10.157, 5.15.80, 6.0.10, and 6.1 as affected.
Exploitation context
No source in the bundle reports active exploitation, and KEV status is false. The provided evidence shows a kernel crash during removal after a failed device-add operation. The sources do not describe a public exploit, weaponized trigger, or remote attack path.
Researcher notes
The root issue is missing error handling for transport_add_device() failure in sas_phy_add(). The crash path involves sas_remove_host(), sas_phy_delete(), transport_remove_device(), and device_del(). Source evidence supports availability impact only; affected-version boundaries and distro backports require vendor-specific confirmation.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize servers or appliances using SAS storage controllers.
- Check distribution advisories for backported kernel packages.
- Schedule reboot or module reload windows required by kernel updates.
- If patching is delayed, reduce unnecessary local access to affected systems.
Validation and detection
- Inventory Linux kernel versions across SAS-capable systems.
- Check whether scsi_transport_sas or SAS controller modules are loaded.
- Map installed kernels against vendor fixed package versions.
- Review crash logs for device_del or sas_phy_delete traces.
- Confirm patched kernels include one of the referenced stable commits.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49839 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/03aabcb88aeeb7221ddb6196ae84ad5fb17b743fCVE reference, Linux
- https://git.kernel.org/stable/c/2f21d653c648735657e23948b1d7ac7273de0f87CVE reference, Linux
- https://git.kernel.org/stable/c/c736876ee294bb4f271d76a25cc7d70c8537bc5dCVE reference, Linux
- https://git.kernel.org/stable/c/5d7bebf2dfb0dc97aac1fbace0910e557ecdb16fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.