LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49951: firmware_loader: Fix use-after-free during unregister

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix use-after-free during unregister In the following code within firmware_upload_unregister(), the call to device_unregister() could result in the dev_release function freeing the fw_upload_priv structure before it is dereferenced for the call to module_put(). This bug was found by the kernel test robot using CONFIG_KASAN while running the firmware selftests. device_unregister(&fw_sysfs->dev); module_put(fw_upload_priv->module); The problem is fixed by copying fw_upload_priv->module to a local variable for use when calling device_unregister().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49951 is a Linux kernel memory-safety bug in firmware upload cleanup. A structure could be freed during device unregister and then reused when releasing a module reference. Public data does not provide a CVSS score, impact rating, or evidence of active exploitation.

Executive priority

Treat this as a kernel maintenance and exposure-tracking item, not an emergency based on current evidence. Prioritize normal kernel patch cycles unless vendor advisories assign higher severity for your environment.

Technical view

The flaw is a use-after-free in firmware_upload_unregister(). device_unregister() could trigger dev_release and free fw_upload_priv before module_put() dereferenced fw_upload_priv->module. The fix copies the module pointer to a local variable before unregistering the device.

Likely exposure

Exposure is limited to Linux kernels containing the affected firmware_loader code. The source bundle lists Linux 5.19-era affected versions and stable kernel fixes. Downstream distribution exposure depends on backports and vendor kernel packaging.

Exploitation context

No cited source states active exploitation, public exploit availability, or KEV listing. The bug was found by the kernel test robot with CONFIG_KASAN during firmware selftests, suggesting discovery through testing rather than observed attacks.

Researcher notes

The available record identifies root cause and fix pattern but omits CVSS, CWE, exploit prerequisites, and user-triggerability. Avoid assuming remote reachability or privilege impact without kernel or vendor analysis.

Mitigation direction

  • Deploy a vendor kernel update that includes the referenced stable firmware_loader fixes.
  • Check Linux distribution advisories for backported fixes before relying on version strings alone.
  • Prioritize systems using affected 5.19-era kernels or custom kernels from vulnerable commits.
  • If patch timing is uncertain, ask the vendor for CVE-2022-49951 fix status.

Validation and detection

  • Inventory kernel versions and package build identifiers across Linux systems.
  • Confirm whether the kernel includes stable commit d380d40930a674c520a5b55f3be1eb17dc634ebc.
  • Confirm whether the kernel includes stable commit 8b40c38e37492b5bdf8e95b46b5cca9517a9957a.
  • Review vendor security notices for CVE-2022-49951 and downstream backport status.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49951 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux97730bbb242cde22b7140acd202ffd88823886c9, 97730bbb242cde22b7140acd202ffd88823886c9unaffected
LinuxLinux5.19, 0, 5.19.8, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.