Security readout for executives and security teams
Plain-English summary
CVE-2022-50733 is a Linux kernel USB driver bug in idmouse. A failed device command can leave part of an input buffer uninitialized, then later code may read it. The public record does not provide CVSS, confirmed impact, or evidence of exploitation.
Executive priority
Treat as routine-to-moderate Linux kernel patching unless your environment allows broad untrusted USB device access. There is no sourced evidence of exploitation or severe impact, but affected kernels should still be updated through normal vulnerability management cycles.
Technical view
In idmouse_open/idmouse_create_image, failures from ftip_command jump to reset while bulk_in_buffer image data may remain uninitialized. A subsequent valid-image check can dereference uninitialized data. The stable fix reorders the check so it only runs when image data is concrete. The issue was found by KMSAN; only kernel compilation testing is noted.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with the USB idmouse driver present or usable. Risk is higher where untrusted USB peripherals can be attached. The CVE record lists multiple affected kernel release lines and kernel stable fix commits.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The available description does not state whether this causes crash, data exposure, or privilege impact. Because it is in a USB driver path, attacker proximity or device access may be relevant, but sources do not fully define prerequisites.
Researcher notes
Evidence is limited. The CVE record provides commit references and root cause, but no CVSS, CWE, exploitability analysis, or runtime test results beyond KMSAN discovery and compile testing. Further assessment should review the exact stable commits and downstream distribution backports.
Mitigation direction
- Update affected Linux kernels to versions containing the referenced stable fixes.
- Check distribution or kernel vendor advisories for backported patches.
- Limit use of untrusted USB devices until patched, where operationally feasible.
- Prioritize systems where USB peripheral access is exposed to users or visitors.
Validation and detection
- Inventory Linux kernel versions across managed systems.
- Check whether the idmouse USB driver is built, loadable, or in use.
- Map installed kernels against vendor advisories and referenced stable commits.
- Confirm patched kernels are deployed after maintenance.
- Monitor vendor guidance for clarified impact or additional affected versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50733 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b3304a6df957cc89a0590cb505388d659bf3db4cCVE reference
- https://git.kernel.org/stable/c/7dad42032f68718259590b0cc7654e9a95ff9762CVE reference
- https://git.kernel.org/stable/c/f589b667567fde4f81d6e6c40f42b9f2224690eaCVE reference
- https://git.kernel.org/stable/c/1eae30c0113dde7522088231584d62415011a035CVE reference
- https://git.kernel.org/stable/c/b8bbae3236ab7dccc66c42bc3f7cdbcfc0786e54CVE reference
- https://git.kernel.org/stable/c/20b8c456df584ebb2387dc23d40ebe4ff334417cCVE reference
- https://git.kernel.org/stable/c/6163a5ae097bc78fa26c243fb384537e25610fd7CVE reference
- https://git.kernel.org/stable/c/adad163d1cff248a5df9f7cec50158e6ca89f33bCVE reference
- https://git.kernel.org/stable/c/bce2b0539933e485d22d6f6f076c0fcd6f185c4cCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.