Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver crash issue. On affected systems, a local user path can trigger a null pointer condition in the bnxt_en network driver during error recovery and coalescing changes, causing a kernel crash. The business impact is availability, not data theft or privilege escalation based on the supplied sources.
Executive priority
Treat this as a moderate availability risk. Prioritize patching for production Linux servers using the affected network driver, especially where unexpected kernel crashes would disrupt critical services. It does not require emergency response unless those systems are exposed to untrusted local users or have recent matching crashes.
Technical view
CVE-2022-49869 is a CWE-476 null pointer dereference in Linux bnxt_en. During error recovery, rtnl_lock is not held throughout, so structures may be freed. The fix checks BNXT_STATE_OPEN instead of netif_running before reconfiguring coalescing settings. CVSS is 5.5: local, low complexity, low privileges, high availability impact.
Likely exposure
Exposure is likely limited to Linux hosts running affected kernel versions with the bnxt_en driver in use. The source lists affected Linux versions around 5.4 through 6.1 and references stable kernel fixes. Systems without this driver or already carrying the stable fixes are less likely exposed.
Exploitation context
The source does not claim active exploitation, and KEV is false. Evidence shows a local ethtool-triggered crash path in a kernel stack trace. No remote attack path, public exploit, or data compromise is described in the supplied material.
Researcher notes
The root issue is state validation during bnxt_en error recovery. The fix changes the operational readiness check before coalescing reconfiguration. The supplied data is sufficient for kernel-version and commit-based validation, but it does not provide distribution package mappings or evidence of exploitation in the wild.
Mitigation direction
- Update affected Linux kernels using vendor-supported packages or stable kernel fixes.
- Confirm the relevant bnxt_en stable commits are included in deployed kernels.
- Prioritize uptime-sensitive servers using the bnxt_en network driver.
- Check vendor advisories for distribution-specific backports and fixed package versions.
Validation and detection
- Inventory Linux kernel versions against the affected ranges and fixed stable commits.
- Identify hosts where the bnxt_en driver is present or active.
- Review kernel logs for bnxt_hwrm_set_coal NULL pointer crashes.
- Confirm patched kernels no longer contain the vulnerable driver logic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a5a05fbef4a0dfe45fe03b2f1d02ba23aebf5384CVE reference, Linux
- https://git.kernel.org/stable/c/38147073c96dce8c7e142ce0e5f305a420a729baCVE reference, Linux
- https://git.kernel.org/stable/c/ac257c43fa615d22180916074feed803b8bb8cb0CVE reference, Linux
- https://git.kernel.org/stable/c/7781e32984cde65549bedc3201537e253297c98dCVE reference, Linux
- https://git.kernel.org/stable/c/6d81ea3765dfa6c8a20822613c81edad1c4a16a0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.