Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a use-after-free in the ASoC audio core cleanup path. A failed initialization can leave an internal dummy platform device registered incorrectly, then cleanup unregisters it twice. The CVSS score is high, but the source describes a local kernel flaw, not a remote service exposure.
Executive priority
Treat as a high-priority kernel maintenance issue for multi-user Linux systems. It does not currently justify emergency remote-exploitation response based on the supplied sources, but kernel memory corruption with high confidentiality, integrity, and availability impact should enter the next expedited patch window.
Technical view
The bug is in snd_soc_exit() after snd_soc_util_init() failure handling in snd_soc_init(). The return value was ignored, allowing soc_dummy_dev to be unregistered during failure handling and again at module exit. KASAN reports use-after-free in device_del during module removal. The fix stops initialization on util_init failure and cleans debugfs on error paths.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel versions with the ASoC core present. The supplied CVSS vector requires local access and low privileges. The affected-version data is broad and somewhat inconsistent, so kernel vendor package status should be treated as authoritative.
Exploitation context
No KEV listing is provided and the bundle does not cite active exploitation. The evidence is a kernel KASAN report and upstream stable fixes. The source does not provide public exploit status, real-world attacks, or weaponized proof-of-concept details.
Researcher notes
The source evidence points to CWE-416 in Linux ASoC core error handling. Affected-version metadata should be cross-checked because one entry repeats a commit-like value while another lists kernel versions. Avoid assuming exploitability beyond local access without additional vendor or researcher evidence.
Mitigation direction
- Apply a vendor kernel update containing the relevant upstream stable fix.
- Prioritize systems allowing untrusted local users or shared shell access.
- Check Linux distribution advisories for backported fixes before judging by version alone.
- Where feasible, reduce unnecessary local account access until patched.
Validation and detection
- Inventory Linux kernel versions and vendor package release levels.
- Confirm whether the kernel includes one of the referenced stable fixes.
- Identify systems using or loading the ASoC core module path.
- Review kernel logs for KASAN, device_del, snd_soc_exit, or module-removal crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49842 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/41fad4f712e081acdfde8b59847f9f66eaf407a0CVE reference, Linux
- https://git.kernel.org/stable/c/90bbdf30a51e42378cb23a312005a022794b8e1eCVE reference, Linux
- https://git.kernel.org/stable/c/a3365e62239dc064019a244bde5686ac18527c22CVE reference, Linux
- https://git.kernel.org/stable/c/2ec3f558db343b045a7c7419cdbaec266b8ac1a7CVE reference, Linux
- https://git.kernel.org/stable/c/8d21554ec7680e9585fb852d933203c3db60dad1CVE reference, Linux
- https://git.kernel.org/stable/c/34eee4189bcebbd5f6a2ff25ef0cb893ad33d51eCVE reference, Linux
- https://git.kernel.org/stable/c/c5674bd073c0fd9f620ca550c5ff08d0d429bdd9CVE reference, Linux
- https://git.kernel.org/stable/c/6ec27c53886c8963729885bcf2dd996eba2767a7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.