Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-leak flaw in the Hyper-V mouse HID driver. If device setup fails, allocated memory may not be freed. The business impact is mainly availability: repeated triggering could contribute to resource exhaustion or service disruption on affected Linux systems.
Executive priority
Treat as a routine but real availability-risk patch for Hyper-V Linux estates. It does not indicate data theft or remote compromise in the provided evidence, but kernel memory leaks can still affect service reliability.
Technical view
CVE-2022-49874 fixes mousevsc_probe() in the Linux Hyper-V HID path. When hid_add_device() returns an error, the driver must call hid_destroy_device() for the hid_dev allocated by hid_allocate_device(). The CVSS vector is local, low complexity, low privilege, no user interaction, availability impact only.
Likely exposure
Exposure is most relevant to Linux kernels using the Hyper-V HID mouse driver, typically Linux guests in Hyper-V environments. The source lists Linux kernel versions and stable commits, but downstream distribution backport status must be checked with each vendor.
Exploitation context
The provided sources do not show active exploitation, and KEV is false. The CVSS vector requires local access and low privileges, so this is not described as a remote initial-access issue. Practical impact depends on whether the vulnerable driver path is reachable.
Researcher notes
The vulnerability is CWE-401 and tied to an error path in mousevsc_probe(). Research should focus on affected kernel build lineage, whether hid_add_device() failure can be induced locally, and whether downstream kernels already carry one of the stable fixes.
Mitigation direction
- Update affected Linux kernels through the distribution or kernel vendor channel.
- Prioritize Hyper-V-hosted Linux workloads where this driver is enabled.
- Check vendor advisories for exact fixed package versions and backports.
- Confirm the relevant stable kernel commit is included after updating.
Validation and detection
- Inventory Linux kernel versions on Hyper-V-hosted systems.
- Check whether the Hyper-V HID mouse driver is present or enabled.
- Map installed kernels to vendor advisories or listed stable commits.
- Verify updates include the mousevsc_probe() memory-leak fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49874 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ed75d1a1c31a0cae8ecc8bcea710b25c0be68da0CVE reference, Linux
- https://git.kernel.org/stable/c/249b743801c00542e9324f87b380032e957a43e8CVE reference, Linux
- https://git.kernel.org/stable/c/a6d2fb1874c52ace1f5cf1966ee558829c5c19b6CVE reference, Linux
- https://git.kernel.org/stable/c/e29289d0d8193fca6d2c1f0a1de75cfc80edec00CVE reference, Linux
- https://git.kernel.org/stable/c/8597b59e3d22b27849bd3e4f92a3d466774bfb04CVE reference, Linux
- https://git.kernel.org/stable/c/5ad95d71344b7ffec360d62591633b3c465dc049CVE reference, Linux
- https://git.kernel.org/stable/c/5f3aba6566b866f5b0a4916f0b2e8a6ae66a6451CVE reference, Linux
- https://git.kernel.org/stable/c/b5bcb94b0954a026bbd671741fdb00e7141f9c91CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.