Security readout for executives and security teams
Plain-English summary
CVE-2022-49853 is a Linux kernel memory leak in macvlan setup. A local user with privileges to create macvlan links could trigger failed setup paths that leave allocated memory behind, potentially degrading availability over time. The source bundle shows no active exploitation and no data theft or integrity impact.
Executive priority
Treat as routine-to-priority Linux kernel hygiene unless affected hosts are shared, multi-tenant, or grant local network administration rights broadly. The business risk is service degradation from memory pressure, not confirmed remote takeover.
Technical view
The leak occurs in macvlan_common_newlink when macvlan mode is source. macvlan_changelink_sources allocates source MAC resources, but if register_netdevice returns an error, those resources are not cleaned up. The kernel fix calls macvlan_flush_sources on the error path. CVSS is 5.5, local, low complexity, low privileges, availability high.
Likely exposure
Exposure is mainly Linux systems where local users or processes can exercise macvlan link creation, commonly requiring network administration privileges. Systems not using macvlan, or where untrusted users lack local network configuration privileges, are less exposed. Distribution-specific affected and fixed package mapping is not provided in the bundle.
Exploitation context
The provided evidence describes a local availability issue and a kmemleak finding, not remote compromise. KEV status is false, and the bundle provides no cited evidence of active exploitation. Triggering depends on a specific macvlan source-mode setup path and an error during device registration.
Researcher notes
Evidence supports CWE-401 memory leak in a macvlan error path. The affected version data is upstream-oriented and includes commit hashes and kernel release markers, but does not provide distribution package names. Do not infer exploit availability beyond local availability impact.
Mitigation direction
- Update to a Linux kernel or vendor package containing the referenced stable fix.
- Check your Linux distribution advisory for affected and fixed kernel package versions.
- Restrict local network administration privileges to trusted users and services.
- Review macvlan use on shared or multi-tenant Linux hosts.
Validation and detection
- Inventory Linux hosts and running kernel versions.
- Identify hosts using macvlan or allowing macvlan creation by local users.
- Check kernel package changelogs for the referenced stable commits.
- Confirm scanners map findings to vendor-fixed kernel packages, not only upstream versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49853 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9f288e338be206713d79b29144c27fca4503c39bCVE reference, Linux
- https://git.kernel.org/stable/c/21d3a8b6a1e39e7529ce9de07316ee13a63f305bCVE reference, Linux
- https://git.kernel.org/stable/c/a81b44d1df1f07f00c0dcc0a0b3d2fa24a46289eCVE reference, Linux
- https://git.kernel.org/stable/c/685e73e3f7a9fb75cbf049a9d0b7c45cc6b57b2eCVE reference, Linux
- https://git.kernel.org/stable/c/956e0216a19994443c90ba2ea6b0b284c9c4f9cbCVE reference, Linux
- https://git.kernel.org/stable/c/a8d67367ab33604326cc37ab44fd1801bf5691baCVE reference, Linux
- https://git.kernel.org/stable/c/9ea003c4671b2fc455320ecf6d4a43b0a3c1878aCVE reference, Linux
- https://git.kernel.org/stable/c/23569b5652ee8e8e55a12f7835f59af6f3cefc30CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.