Security readout for executives and security teams
Plain-English summary
CVE-2022-49922 is a Linux kernel memory leak in an NFC driver path. A local, low-privileged actor could potentially trigger failed NFC I2C sends and consume memory, affecting availability. There is no source-provided evidence of active exploitation or KEV listing.
Executive priority
Treat as routine-to-priority Linux patching, higher for fleets with NFC hardware, embedded Linux, or kiosk-like devices. It is not currently supported by the sources as an internet-exploited emergency, but availability impact can matter on sensitive systems.
Technical view
The issue is in nfcmrvl_i2c_nci_send(). When i2c_master_send() failed, the socket buffer was not freed, causing a memory leak. The kernel fix frees the skb regardless of send success. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no confidentiality or integrity impact, high availability impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with the nfcmrvl NFC I2C driver present or enabled. The source lists Linux 4.4 through 6.1-era affected versions and stable fix commits. Systems without this driver or NFC hardware are likely lower exposure, but validation is required.
Exploitation context
Sources indicate local access and low privileges are required. The practical impact is denial of service through memory exhaustion, not data theft or code execution. The provided sources do not report public exploitation, weaponized exploit availability, or inclusion in CISA KEV.
Researcher notes
The CVE record describes a resolved CWE-401 memory leak in nfcmrvl_i2c_nci_send(). Affected-version data in the bundle is broad and includes stable commit references. Confirm exposure through kernel source/config, module presence, and distribution backports rather than upstream version alone.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize systems with NFC hardware or nfcmrvl driver exposure.
- If patching is delayed, check vendor guidance for supported workarounds.
- Consider disabling unused NFC functionality where operationally safe and vendor-supported.
Validation and detection
- Inventory Linux kernel versions across servers, endpoints, and embedded devices.
- Check whether nfcmrvl or related NFC I2C driver support is enabled.
- Map installed kernels against vendor advisories and stable fix commits.
- Confirm patched kernels are installed and running after reboot.
- Monitor for unusual memory pressure on potentially exposed systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49922 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dd0ee55ead91fbb16889dbe7ff0b0f7c9e4e849dCVE reference, Linux
- https://git.kernel.org/stable/c/825656ae61e73ddc05f585e6258d284c87064b10CVE reference, Linux
- https://git.kernel.org/stable/c/c8e7d4a1166f063703955f1b2e765a6db5bf1771CVE reference, Linux
- https://git.kernel.org/stable/c/f30060efcf18883748a0541aa41acef183cd9c0eCVE reference, Linux
- https://git.kernel.org/stable/c/52438e734c1566f5e2bcd9a065d2d65e306c0555CVE reference, Linux
- https://git.kernel.org/stable/c/5dfdac5e3f8db5f4445228c44f64091045644a3bCVE reference, Linux
- https://git.kernel.org/stable/c/92a1df9c6da20c02cf9872f8b025a66ddb307aebCVE reference, Linux
- https://git.kernel.org/stable/c/93d904a734a74c54d945a9884b4962977f1176cdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.