Security readout for executives and security teams
Plain-English summary
This is a Linux kernel network-driver flaw that can crash an affected system if a memory allocation failure leaves an invalid buffer address for later reuse. Business impact is service outage, not confirmed data theft or code execution, based on the supplied sources.
Executive priority
Handle during normal vulnerability remediation unless the affected hardware supports critical network services. Escalate if exposed systems are availability-sensitive, difficult to reboot safely, or lack a vendor-supported kernel update path.
Technical view
The lantiq_xrx200 network driver can store an invalid buffer address after allocation failure. When the descriptor is reused, build_skb() may access invalid memory and panic the kernel. The sources identify Linux kernel versions and stable commits, but provide no CVSS, CWE, or attacker precondition detail.
Likely exposure
Exposure appears limited to Linux systems using the Lantiq XRX200 network driver or affected kernel code paths. The source bundle lists Linux 5.13, 5.19.6, and 6.0-related version data, but exact downstream distro package exposure requires vendor confirmation.
Exploitation context
CISA KEV is false in the bundle, and no cited source states active exploitation. The sources do not confirm whether the condition is remotely triggerable, local-only, or dependent on resource exhaustion. Treat it primarily as a potential denial-of-service risk.
Researcher notes
The record is sparse: no CVSS, CWE, exploit status, or precise attacker model is provided. The strongest supported conclusion is kernel denial of service through descriptor reuse after allocation failure in lantiq_xrx200, fixed by referenced Linux stable commits.
Mitigation direction
- Upgrade to a kernel or vendor package containing the referenced stable fixes.
- Check distribution advisories for backported fixes before relying on upstream version numbers.
- Prioritize embedded or network-edge systems using Lantiq XRX200 hardware.
- Monitor affected systems for kernel panic or build_skb-related crash logs.
Validation and detection
- Inventory Linux kernel versions across systems with Lantiq XRX200 network hardware.
- Confirm whether the lantiq_xrx200 driver is built, loaded, or in use.
- Compare installed kernel packages against vendor advisories or referenced stable commits.
- Review crash logs for build_skb() panics involving the network driver.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49997 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3ef2786e32d93e562cd40601248a14ae090de873CVE reference, Linux
- https://git.kernel.org/stable/c/c9c3b1775f80fa21f5bff874027d2ccb10f5d90cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.