Security readout for executives and security teams
Plain-English summary
CVE-2022-49931 is a Linux kernel availability issue in the hfi1 driver. Under specific link-down conditions with pending send waiters, the kernel can crash. This is operationally important for systems that use this driver, but the source bundle indicates local, low-complexity access is required and does not show active exploitation.
Executive priority
Treat this as a moderate-priority availability risk for specialized Linux infrastructure using hfi1. It is not presented as remotely exploitable or actively exploited, but affected production systems could crash under the documented conditions.
Technical view
The flaw is a NULL pointer dereference in IB/hfi1 sc_disable() caused by incorrect list movement introduced by an earlier locking fix. When a link goes down while send-completion waiters exist, the hfi1 path can crash the kernel. CVSS is 5.5: local, low complexity, low privileges, availability-only impact.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions or commits and using the hfi1 driver. Systems not using hfi1 or not on the listed affected kernel builds are less likely exposed based on the provided sources.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. The trigger requires local conditions and a specific hfi1 link-down state with pending send waiters, so this is primarily a reliability and denial-of-service concern.
Researcher notes
Evidence supports CWE-476 and availability-only impact. The source bundle identifies stable kernel commits as fixes but does not provide distribution-specific package names, broad exploit evidence, or proof that non-hfi1 systems are affected.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize Linux hosts that load or depend on the hfi1 driver.
- Check distribution advisories before backporting kernel changes manually.
- Reduce reliance on affected hfi1 systems until patched, where operationally feasible.
Validation and detection
- Inventory Linux kernel versions against the affected versions listed in the CVE bundle.
- Confirm whether the hfi1 driver is present, loaded, or operationally required.
- Check vendor kernel packages for the referenced stable fix commits.
- Review kernel crash logs for sc_disable, pio_freeze, handle_freeze, or hfi1 traces.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 25760a41e3802f54aadcc31385543665ab349b8e
- Linux stable commit 7c4260f8f188df32414a5ecad63e8b934c2aa3f0
- Linux stable commit ba95409d6b580501ff6d78efd00064f7df669926
- Linux stable commit b8bcff99b07cc175a6ee12a52db51cdd2229586c
- Linux stable commit 1afac08b39d85437187bb2a92d89a741b1078f55
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49931 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8eCVE reference, Linux
- https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0CVE reference, Linux
- https://git.kernel.org/stable/c/ba95409d6b580501ff6d78efd00064f7df669926CVE reference, Linux
- https://git.kernel.org/stable/c/b8bcff99b07cc175a6ee12a52db51cdd2229586cCVE reference, Linux
- https://git.kernel.org/stable/c/1afac08b39d85437187bb2a92d89a741b1078f55CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.