Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash certain systems during boot when the Intel i915 graphics driver initializes. The public record describes an Asus Chromebook CX550 on a 5.17 release-candidate kernel reaching a fatal kernel panic. Business impact is availability: affected devices may fail to boot until a fixed kernel is used.
Executive priority
Handle this as a stability and availability issue. It is not evidenced as actively exploited, but affected endpoints may be unable to boot. Patch through normal kernel maintenance, with faster action for fleets using Intel i915 graphics or affected Chromebook-class hardware.
Technical view
CVE-2022-49960 is a NULL pointer dereference of bi_next in tgl_get_bw_info() within drivers/gpu/drm/i915/display/intel_bw.c. The crash occurs during i915 hardware probing in early boot and can lead to kernel panic. The source references upstream/stable kernel commits resolving the defect, but provides no CVSS, CWE, or exploitability detail.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with Intel i915 graphics paths that exercise this bandwidth initialization logic. The only concrete impacted hardware named is Asus Chromebook CX550 / Google Delbin on Linux 5.17-rc1. Broader exposure should be verified against vendor kernel backports and the referenced commits.
Exploitation context
No active exploitation is reported in the supplied sources, and the CVE is not marked KEV. The evidence describes a boot-time crash rather than a remote attack path. Public details are insufficient to claim practical attacker exploitation, privilege impact, or network exposure.
Researcher notes
The record lacks CVSS, CWE, exploitability analysis, and complete product-version mapping. The affected-version data should be treated cautiously and reconciled with kernel git history and distribution backports. The strongest technical signal is the named NULL dereference and call trace in i915 initialization.
Mitigation direction
- Update affected Linux kernels to versions containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes for CVE-2022-49960.
- Prioritize devices with Intel i915 graphics and affected kernel builds.
- Avoid affected release-candidate kernels on impacted hardware.
- Use vendor-supported kernels rather than ad hoc local patches.
Validation and detection
- Inventory Linux kernel versions across Intel i915-equipped systems.
- Compare deployed kernel changelogs against the referenced fix commits.
- Review boot logs for tgl_get_bw_info or i915 kernel panic traces.
- Test reboot on representative affected hardware after updating.
- Confirm vendor advisory status for packaged kernel fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49960 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c2798203315f4729bab0b917bf4c17a159abf9f8CVE reference, Linux
- https://git.kernel.org/stable/c/458ec0c8f35963626ccd51c3d50b752de5f1b9d4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.