Security readout for executives and security teams
Plain-English summary
CVE-2022-49861 is a Linux kernel resource leak in the Marvell XOR v2 DMA engine driver. A local user with low privileges could trigger an availability impact on affected systems. The provided sources do not show data theft, data modification, remote exploitation, or confirmed active exploitation.
Executive priority
Treat as a routine but real availability risk. It should be included in normal Linux kernel patch cycles, with higher priority for systems allowing local user access or running relevant Marvell DMA hardware support.
Technical view
The kernel driver probe enables a clock with clk_prepare_enable(), but mv_xor_v2_remove() lacked the matching clk_disable_unprepare(). The fix adds that missing cleanup call. CVSS 3.1 is 5.5 with local attack vector, low privileges, no user interaction, and high availability impact only.
Likely exposure
Exposure appears limited to affected Linux kernel versions where the mv_xor_v2 DMA engine driver is present or built into deployed kernels. Systems without this driver or outside the listed affected versions are less likely exposed, but confirm against vendor kernel packages.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation. The CVSS vector indicates local, low-complexity exploitation requiring low privileges, with impact limited to availability. No remote attack path is supported by the provided sources.
Researcher notes
The evidence is narrow: a missing cleanup call in a specific kernel driver and stable kernel commits fixing it. The bundle does not provide proof-of-concept details, exploitation reports, or vendor-specific package mappings, so validation should rely on kernel source and distribution advisories.
Mitigation direction
- Apply Linux vendor kernel updates containing the referenced stable fixes.
- Check distribution advisories for the exact fixed package version.
- Prioritize systems using affected kernels and the mv_xor_v2 driver.
- Reboot into the fixed kernel after patching, if required.
- If patching is delayed, reduce local untrusted user access.
Validation and detection
- Inventory running kernel versions across Linux assets.
- Confirm whether mv_xor_v2 is present, built, or loaded on each system.
- Verify vendor changelogs reference CVE-2022-49861 or the stable commit IDs.
- Confirm patched source includes clk_disable_unprepare() in mv_xor_v2_remove().
- Retire or update affected kernel builds after validation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/04f2cc56d80a1ac058045a7835c5bfd910f17863CVE reference, Linux
- https://git.kernel.org/stable/c/4b6641c3a2ba95ddcfecec263b4a5e572a4b0641CVE reference, Linux
- https://git.kernel.org/stable/c/20479886b40c0ed4864a5fc8490a1f6b70cccf1bCVE reference, Linux
- https://git.kernel.org/stable/c/1d84887327659c58a6637060ac8c50c3a952a163CVE reference, Linux
- https://git.kernel.org/stable/c/0b7ee3d50f32d277bf024b4ddb4de54da43a3025CVE reference, Linux
- https://git.kernel.org/stable/c/992e966caf57e00855edbd79f19d911809732a69CVE reference, Linux
- https://git.kernel.org/stable/c/a1cb72e20a64a3c83f9b4ee993fbf97e4c1d7714CVE reference, Linux
- https://git.kernel.org/stable/c/081195d17a0c4c636da2b869bd5809d42e8cbb13CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.