Security readout for executives and security teams
Plain-English summary
This is a Linux kernel regression in USB Type-C UCSI handling. A stale power-supply sysfs entry can remain after connector cleanup, leading to a NULL pointer dereference when that sysfs data is read. Business impact is most likely system instability or denial of service, not confirmed data theft.
Executive priority
Treat as a targeted reliability risk for affected Linux systems. Prioritize normal kernel patching, with faster handling for laptops, workstations, or appliances where USB Type-C UCSI paths are in use.
Technical view
Commit 87d0e2f41b8c changed UCSI connector unregister error handling. When con->wq is NULL, power device cleanup can be skipped, leaving a sysfs entry with NULL ops. The kernel fix cited is a straight revert through stable commits.
Likely exposure
Exposure is limited to Linux kernels containing the faulty UCSI change. The bundle lists Linux 5.19, 5.19.8, and 6.0 as affected. Downstream distribution package status is not provided.
Exploitation context
The bundle does not cite active exploitation, public exploit activity, or KEV listing. The described trigger is reading affected power-supply sysfs data, but source evidence does not define remote reachability or attacker prerequisites.
Researcher notes
Evidence is narrow: the CVE text describes a regression and revert, with no CVSS, CWE, or exploit evidence. Validate by commit presence and downstream backport status rather than version strings alone.
Mitigation direction
- Check vendor kernel advisories for CVE-2022-49944 status.
- Apply kernel updates containing the cited stable revert.
- Prioritize systems using USB Type-C UCSI functionality.
- Use an unaffected vendor-supported kernel if updates are unavailable.
Validation and detection
- Inventory Linux kernel versions across affected assets.
- Confirm whether kernels include commit 87d0e2f41b8c.
- Confirm whether stable revert commits are present.
- Review logs for kernel NULL dereference crashes around UCSI or power_supply sysfs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49944 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3d4044c9e6d2e3f11f1f8b5e0ee8647d3eb1afadCVE reference, Linux
- https://git.kernel.org/stable/c/5f73aa2cf8bef4a39baa1591c3144ede4788826eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.