Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-leak bug in the WWAN hardware simulator component. When device registration fails during module probing, an allocated device name may not be freed. The available sources show a resolved kernel bug, not evidence of remote compromise or active exploitation.
Executive priority
Handle through normal kernel patch management unless the simulator module is broadly enabled or local untrusted users can influence module probing. No source indicates emergency exploitation pressure.
Technical view
In wwan_hwsim_dev_new(), device_register() failure left the kobject reference path incomplete, leaking the name allocated by dev_set_name(). The fix calls put_device() so kobject_cleanup() can free the name. Sources identify Linux kernel affected versions and stable commits only.
Likely exposure
Exposure appears limited to Linux systems using or allowing the wwan_hwsim kernel module on affected kernel versions, especially test, simulation, or development environments. Production exposure is likely lower unless this simulator module is present and reachable through local administrative workflows.
Exploitation context
The source bundle does not show KEV listing, public exploitation, or a remote attack path. The described condition involves module probing with a device_register() failure, including fault-injection context. Treat exploitation evidence as absent, not disproven.
Researcher notes
Evidence is narrow: a memory leak in a Linux kernel simulator driver failure path, fixed by releasing the device reference. No CVSS, CWE, exploit details, or distribution-specific fixed package data are provided in the bundle.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes.
- Restrict unnecessary loading of the wwan_hwsim module.
- Prioritize systems where untrusted users can trigger module loading.
- Track kernel package versions against affected ranges from vendor guidance.
Validation and detection
- Inventory systems with the wwan_hwsim module available or loaded.
- Check running kernel versions against vendor fixed packages.
- Review kernel logs for repeated wwan_hwsim probe failures.
- Confirm patched kernels include one of the referenced stable fixes.
- Document exceptions where the simulator module is required.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50331 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.