Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can leak network device references when default queue disciplines fail during setup and the fallback path replaces them. The visible impact is operational: network devices may not be freed cleanly, shown by unregister_netdevice waiting on leaked references. Public sources do not provide CVSS, exploitation evidence, or a named attacker path.
Executive priority
Handle through normal kernel maintenance unless logs show network device cleanup failures or affected hosts are critical. There is no source-backed evidence of active exploitation or remote compromise, but unresolved kernel resource leaks can create reliability risk in high-churn networking environments.
Technical view
The bug is in net/sched attach_default_qdiscs(). If queue 0 fails qdisc attachment under memory pressure while other queues succeed, fallback to noqueue can attach over existing non-noop qdiscs without releasing them, leaking netdevice references. The upstream fix clears non-noop qdiscs before reattaching.
Likely exposure
Exposure is limited to Linux kernels matching the affected versions or vulnerable commits identified by CVE sources. The scenario involves multiqueue network devices, default qdisc attachment, and allocation failure. Distribution kernels may differ because of backports, so version checks alone are not enough.
Exploitation context
The source bundle does not show active exploitation, public exploit code, or KEV listing. The described trigger requires a qdisc attachment failure, apparently due to lack of memory, followed by fallback handling. Treat this as an availability and resource-leak concern unless vendor guidance says otherwise.
Researcher notes
Focus analysis on attach_default_qdiscs(), attach_one_default_qdisc(), fallback to noqueue, and reference lifecycle around non-noop qdiscs. The available evidence supports a reference leak fix, not a broader exploit primitive. CVSS, CWE, and precise distro impact are not provided in the bundle.
Mitigation direction
- Update to a Linux kernel containing one of the referenced stable fixes.
- Check distribution vendor advisories for backported fixes before relying on upstream version numbers.
- Prioritize hosts with heavy virtual networking, containers, or frequent interface creation.
- Monitor for unregister_netdevice waits or netdevice reference leak messages.
- If patch status is unclear, request vendor confirmation for CVE-2022-49958.
Validation and detection
- Inventory Linux kernel versions and vendor build identifiers across affected fleets.
- Compare installed kernels with distribution advisories and referenced upstream stable commits.
- Review kernel logs for qdisc fallback and leaked reference messages.
- Identify systems using multiqueue virtual or physical network devices.
- Confirm patched systems no longer report netdevice unregister waits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49958 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/44dfa645895a56f65461249deb5b81cd16560e2aCVE reference, Linux
- https://git.kernel.org/stable/c/a420d587260185407eda9c5766cfa9bdd5c39a56CVE reference, Linux
- https://git.kernel.org/stable/c/0c6c522857151ac00150fd01baeebf231fb7d142CVE reference, Linux
- https://git.kernel.org/stable/c/f612466ebecb12a00d9152344ddda6f6345f04dcCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.