Security readout for executives and security teams
Plain-English summary
CVE-2022-49920 is a Linux kernel race condition in netfilter nf_tables. A local low-privileged user could potentially trigger a kernel availability failure. The public record rates it medium severity, with high attack complexity and no confidentiality or integrity impact identified.
Executive priority
Treat as routine but important kernel maintenance. Prioritize shared systems, multi-user servers, and environments where local users are less trusted. No source indicates active exploitation, but availability impact can still disrupt critical workloads.
Technical view
The issue is CWE-362 in nf_tables transaction cleanup. A netlink notifier can race with the RCU-based commit release path and remove objects still referenced by a transaction context. The kernel fix calls rcu_barrier() when pending transaction destruction exists, ensuring RCU callbacks complete before release continues.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with netfilter nf_tables present. The CVE data lists affected Linux kernel versions including 5.12, 5.15.78, 6.0.8, and 6.1, but distro-specific backport status is not provided.
Exploitation context
The CVSS vector requires local access, low privileges, no user interaction, and high attack complexity. Impact is availability only. The source bundle does not indicate public exploitation, and KEV status is false.
Researcher notes
The public record is concise and kernel-focused. It identifies the race and fix approach, but does not provide distro matrices, exploit evidence, or operational mitigations beyond applying fixed kernel code. Validate exposure through vendor backport information, not version numbers alone.
Mitigation direction
- Check your Linux distribution or vendor advisory for patched kernel packages.
- Prioritize kernel updates that include the referenced stable commits.
- Reboot systems after kernel updates where required by your platform.
- If immediate patching is blocked, reduce unnecessary local user access.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and appliances.
- Confirm whether vendor kernels include the referenced stable fixes or backports.
- Identify systems using affected kernel branches listed in the CVE data.
- Track remediation through package management or kernel build records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49920 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1ffe7100411a8b9015115ce124cd6c9c9da6f8e3CVE reference, Linux
- https://git.kernel.org/stable/c/e40b7c44d19e327ad8b49a491ef1fa8dcc4566e0CVE reference, Linux
- https://git.kernel.org/stable/c/d4bc8271db21ea9f1c86a1ca4d64999f184d4aaeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.