Security readout for executives and security teams
Plain-English summary
CVE-2022-49925 is a Linux kernel RDMA core bug that can crash the kernel in a cleanup path after an initialization failure. The business impact is availability loss on affected Linux systems. The CVE is rated medium, requires local access, and is not listed as known exploited in CISA KEV.
Executive priority
Treat as routine-to-priority patching for Linux systems where availability matters, especially multi-user servers and RDMA-capable environments. It is not currently a KEV-listed emergency, but a local crash risk can still affect service reliability.
Technical view
The flaw is a NULL pointer dereference in ib_core_cleanup(). If roce_gid_mgmt_init() fails, gid_cache_wq may remain unallocated, but cleanup later calls destroy_workqueue() on it. The issue is classified as CWE-476 with CVSS 3.1 score 5.5: local, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with RDMA core functionality present. The source lists Linux kernel versions including 4.3 and fixes across stable branches. Distribution backports may change exposure, so asset owners should compare running kernels against vendor advisories and the referenced stable commits.
Exploitation context
The provided sources do not report active exploitation. The CVSS vector indicates exploitation requires local privileges and primarily affects availability. The documented trigger involves an RDMA core initialization failure followed by module cleanup, causing a kernel NULL pointer dereference.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. The record describes the root cause and fix direction but does not provide distribution-specific package names, exploit reports, or operational mitigations beyond applying fixed kernels.
Mitigation direction
- Apply Linux kernel updates that include the referenced stable fixes.
- Check your Linux distribution’s advisory for backported fixes.
- Prioritize systems where local users or workloads can access affected kernels.
- Review whether RDMA-related kernel modules are present or used.
- If no vendor package is available, follow vendor guidance before changing kernel modules.
Validation and detection
- Inventory running Linux kernel versions across servers and appliances.
- Map kernel builds to distribution security advisories and stable commits.
- Confirm whether RDMA core modules are installed, loadable, or active.
- Verify updated systems run a kernel containing the fix.
- Monitor logs for kernel crashes involving ib_core_cleanup or destroy_workqueue.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49925 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/af8fb5a0600e9ae29950e9422a032c3c22649ee5CVE reference, Linux
- https://git.kernel.org/stable/c/d360e875c011a005628525bf290322058927e7dcCVE reference, Linux
- https://git.kernel.org/stable/c/6b3d5dcb12347f3518308c2c9d2cf72453a3e1e5CVE reference, Linux
- https://git.kernel.org/stable/c/ab817f75e5e0fa58d9be0825da6a7b7d8a1fa1d9CVE reference, Linux
- https://git.kernel.org/stable/c/07c0d131cc0fe1f3981a42958fc52d573d303d89CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.