Security readout for executives and security teams
Plain-English summary
A memory leak in a Linux WWAN modem driver can waste kernel memory when the driver reads power configuration from BIOS. The stated impact is availability, not data theft or tampering. The bundle does not show active exploitation, and CISA KEV status is false.
Executive priority
Schedule remediation through the normal kernel patch cycle, with higher priority where WWAN hardware is present or local multi-user access exists. This is not supported as actively exploited in the provided sources.
Technical view
CVE-2022-49855 is a Linux kernel CWE-401 issue in net/wwan/iosm. ipc_pcie_read_bios_cfg() calls acpi_evaluate_dsm() to obtain WWAN BIOS power-state configuration but failed to free the returned acpi_object. The CVSS vector is local, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most relevant to Linux systems using the WWAN iosm PCIe driver path. The bundle lists Linux kernel versions 5.14, 5.15.79, 6.0.9, and 6.1 as affected; distribution backports may change practical exposure.
Exploitation context
The source bundle provides no exploit reports and marks KEV as false. The CVSS vector requires local access with low privileges. Treat this as a local availability risk rather than an internet-facing remote compromise based on the provided evidence.
Researcher notes
The fix frees the acpi_object returned by acpi_evaluate_dsm() after use. Validation should focus on kernel branch provenance and downstream backports, because the source bundle names upstream commits but not distribution-specific package versions.
Mitigation direction
- Check vendor or Linux distribution advisories for a kernel carrying the referenced fix.
- Prioritize updates on laptops, gateways, or systems using WWAN iosm hardware.
- Apply a supported kernel update through normal change control.
- If immediate updating is impossible, review vendor guidance for temporary risk reduction.
Validation and detection
- Inventory running Linux kernel versions and compare them with vendor fixed package data.
- Identify systems with WWAN iosm driver exposure or relevant hardware.
- Confirm installed kernel changelogs include one of the referenced stable commits.
- Monitor affected systems for abnormal kernel memory growth or availability symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49855 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/13b1ea861e8aeb701bcfbfe436b943efa2d44029CVE reference, Linux
- https://git.kernel.org/stable/c/7560ceef4d2832a67e8781d924e129c7f542376fCVE reference, Linux
- https://git.kernel.org/stable/c/d38a648d2d6cc7bee11c6f533ff9426a00c2a74cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.