Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a memory leak in AMD GPU power-management code. It may waste kernel memory when affected AMD GPU driver paths initialize and shut down SMC tables. The source bundle does not show data theft, privilege escalation, remote exploitation, or active exploitation.
Executive priority
Treat this as routine kernel hygiene unless affected GPU systems show memory pressure or run critical long-lived workloads. Patch through normal maintenance cycles after confirming distribution fix status.
Technical view
The bug is a missing free for gpu_metrics_table: allocation occurs in smu_v13_0_4_init_smc_tables(), but cleanup in smu_v13_0_4_fini_smc_tables() did not release it. The CVE data lists Linux kernel 5.19-era versions as affected and points to stable kernel commits fixing the leak.
Likely exposure
Exposure is likely limited to Linux systems running affected 5.19-line kernels with AMD GPU power-management code in use. Downstream distributions may have backported the stable fixes, so package version alone may not prove exposure.
Exploitation context
The bundle marks KEV as false and provides no evidence of public exploitation. The described impact is resource leakage, not a direct code execution path. Risk depends on whether the leak can be repeatedly triggered in operational conditions.
Researcher notes
No CVSS, CWE, or exploit details are provided. The useful anchors are the function names and two stable commit URLs. Validate exposure through source or vendor backport evidence rather than assuming every 5.19-labeled package remains vulnerable.
Mitigation direction
- Update to a kernel build containing the referenced stable fixes.
- Check distribution advisories for backported AMDGPU fixes.
- Prioritize systems with AMD GPUs and long uptime.
- Monitor vendor guidance if fixed package status is unclear.
Validation and detection
- Inventory Linux kernel versions across GPU-enabled systems.
- Confirm whether AMDGPU power-management support is present.
- Review kernel package changelogs for the referenced fix commits.
- Track kernel memory behavior on suspect hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49971 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b25bdb54578f3b96ff055e5d27bc1cb82950e51CVE reference, Linux
- https://git.kernel.org/stable/c/5afb76522a0af0513b6dc01f84128a73206b051bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.