Security readout for executives and security teams
Plain-English summary
CVE-2022-49949 is a Linux kernel memory-leak bug in firmware upload handling. A kernel object allocated during firmware upload registration was not freed during device release. The public record does not provide CVSS scoring, a confirmed impact beyond memory leakage, or evidence of active exploitation.
Executive priority
Track this as a kernel hygiene update unless vendor advisories raise severity. There is no provided evidence of active exploitation or broad remote exposure, but kernel memory leaks can affect reliability and should be remediated through normal patch cycles.
Technical view
The issue is in the Linux firmware_loader firmware-upload path. struct fw_upload is allocated in firmware_upload_register(), but fw_dev_release() did not free it. The kernel fix adds fw_upload_free() in sysfs_upload.c and includes the missing kfree for the fw_upload structure.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel builds with the firmware-upload feature present. The source bundle names Linux kernel versions including 5.19, 5.19.8, and 6.0 entries, but package-level distribution impact must be verified against vendor advisories and backports.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation. It also does not describe a remote attack path, privilege requirement, denial-of-service threshold, or practical exploitation conditions. Treat exploitation likelihood as unproven from the provided evidence.
Researcher notes
The record is sparse: no CVSS, CWE, exploitability details, or product matrix beyond Linux kernel version data and stable commit references. Further analysis should inspect the referenced commits and distribution advisories, but avoid assuming exploitability from the memory-leak description alone.
Mitigation direction
- Apply a Linux kernel update containing the referenced stable fixes.
- Check distribution advisories for backported fixes in supported kernel packages.
- If no update is available, follow vendor guidance for mitigation or backport status.
- Prioritize systems where firmware upload paths are operationally used or exposed to administrators.
Validation and detection
- Inventory Linux kernel versions and vendor package build identifiers across systems.
- Confirm whether vendor changelogs include the referenced firmware_loader fix.
- Map systems using firmware-upload functionality or related sysfs interfaces.
- Check vulnerability scanner results against distribution-specific fixed package versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49949 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/baf92485d111be828e1ab84a995515b604b938e5CVE reference, Linux
- https://git.kernel.org/stable/c/789bba82f63c3e81dce426ba457fc7905b30ac6eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.