LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49976: platform/x86: x86-android-tablets: Fix broken touchscreen on Chuwi Hi8 with Windows BIOS

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Fix broken touchscreen on Chuwi Hi8 with Windows BIOS The x86-android-tablets handling for the Chuwi Hi8 is only necessary with the Android BIOS and it is causing problems with the Windows BIOS version. Specifically when trying to register the already present touchscreen x86_acpi_irq_helper_get() calls acpi_unregister_gsi(), this breaks the working of the touchscreen and also leads to an oops: [ 14.248946] ------------[ cut here ]------------ [ 14.248954] remove_proc_entry: removing non-empty directory 'irq/75', leaking at least 'MSSL0001:00' [ 14.248983] WARNING: CPU: 3 PID: 440 at fs/proc/generic.c:718 remove_proc_entry ... [ 14.249293] unregister_irq_proc+0xe0/0x100 [ 14.249305] free_desc+0x29/0x70 [ 14.249312] irq_free_descs+0x4b/0x80 [ 14.249320] mp_unmap_irq+0x5c/0x60 [ 14.249329] acpi_unregister_gsi_ioapic+0x2a/0x40 [ 14.249338] x86_acpi_irq_helper_get+0x4b/0x190 [x86_android_tablets] [ 14.249355] x86_android_tablet_init+0x178/0xe34 [x86_android_tablets] Add an init callback for the Chuwi Hi8, which detects when the Windows BIOS is in use and exits with -ENODEV in that case, fixing this.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel hardware-quirk bug for Chuwi Hi8 tablets. On systems using the Windows BIOS, Android-BIOS-specific handling can break an already working touchscreen and trigger a kernel warning/oops. Business impact appears limited to affected niche tablet deployments, not broad server or cloud exposure.

Executive priority

Treat this as low priority unless the organization operates Chuwi Hi8 tablets or similar managed Linux tablet fleets. Patch through normal kernel maintenance, with targeted validation for touchscreen-dependent devices.

Technical view

The x86-android-tablets driver applied Chuwi Hi8 handling when it was only needed for the Android BIOS. With the Windows BIOS, registration of an already present touchscreen caused x86_acpi_irq_helper_get() to call acpi_unregister_gsi(), disrupting IRQ state and producing an oops. The fix adds Chuwi Hi8 init detection and exits with -ENODEV for Windows BIOS.

Likely exposure

Exposure appears limited to Linux systems on Chuwi Hi8 hardware using the affected kernel driver and Windows BIOS path. The supplied data lists Linux kernel versions around 5.17 through 6.0 and referenced stable commits, but does not provide complete distribution package mappings.

Exploitation context

No KEV listing is present, and the supplied sources do not cite active exploitation. The evidence describes a device-specific reliability failure caused during driver initialization, not a remotely exploitable attack path.

Researcher notes

The source record lacks CVSS, CWE, and complete distro status. Analysis should remain constrained to the Chuwi Hi8 x86-android-tablets path and the two stable kernel commits. Do not generalize this to all touchscreens or all Linux tablets without more evidence.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check Linux distribution advisories for exact fixed package versions.
  • Prioritize affected Chuwi Hi8 tablet fleets over general Linux infrastructure.
  • Avoid inventing local workarounds; follow vendor kernel guidance.

Validation and detection

  • Inventory Linux devices for Chuwi Hi8 hardware and BIOS type.
  • Check running kernel versions against vendor fixed package guidance.
  • Review boot logs for x86_android_tablets touchscreen or IRQ oops messages.
  • Confirm touchscreen functionality after applying the fixed kernel.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49976 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux84c2dcdd475f3f5d1d30c87404cafba4dd4b75ec, 84c2dcdd475f3f5d1d30c87404cafba4dd4b75ecunaffected
LinuxLinux5.17, 0, 5.19.8, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.