LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49950: misc: fastrpc: fix memory corruption on open

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on open The probe session-duplication overflow check incremented the session count also when there were no more available sessions so that memory beyond the fixed-size slab-allocated session array could be corrupted in fastrpc_session_alloc() on open().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49950 is a Linux kernel fastrpc memory corruption flaw triggered during open handling. The public record says a session-count overflow check could still advance past the fixed session array, corrupting adjacent memory. No CVSS score or confirmed exploitation is provided.

Executive priority

Prioritize assessment and routine kernel patching. Escalate only where affected kernels expose fastrpc on important systems, because the public evidence lacks severity scoring and exploitation confirmation.

Technical view

The flaw is in fastrpc_session_alloc() during open(). A probe session-duplication overflow check incremented the session count even when no sessions remained, allowing writes beyond a fixed-size slab-allocated session array. Kernel stable commits are listed as references for the resolved issue.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds with the fastrpc code present and reachable. The bundle lists Linux kernel versions and stable commits but does not identify distributions, appliances, or enabled-by-default exposure.

Exploitation context

The source bundle does not report active exploitation, proof-of-concept availability, or KEV listing. Treat exploitability as unconfirmed from these sources, while recognizing that kernel memory corruption can be operationally significant.

Researcher notes

Evidence supports a bounds/session accounting bug in Linux fastrpc open handling. The bundle does not provide CVSS, CWE, exploit details, affected distributions, or operational mitigations beyond the kernel fix references.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Confirm distribution advisories before assuming a specific package is fixed.
  • Prioritize systems where fastrpc is present and reachable.
  • Track kernel versions listed in the CVE record during remediation.

Validation and detection

  • Inventory Linux kernel versions across affected environments.
  • Check whether deployed kernels include the referenced stable commits.
  • Review vendor advisories for fixed package versions.
  • Confirm fastrpc presence and access on in-scope systems.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49950 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf6f9279f2bf0e37e2f1fb119d8832b8568536a04, f6f9279f2bf0e37e2f1fb119d8832b8568536a04, f6f9279f2bf0e37e2f1fb119d8832b8568536a04, f6f9279f2bf0e37e2f1fb119d8832b8568536a04, f6f9279f2bf0e37e2f1fb119d8832b8568536a04unaffected
LinuxLinux5.1, 0, 5.4.213, 5.10.142, 5.15.66, 5.19.8, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.