LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48645: net: enetc: deny offload of tc-based TSN features on VF interfaces

In the Linux kernel, the following vulnerability has been resolved: net: enetc: deny offload of tc-based TSN features on VF interfaces TSN features on the ENETC (taprio, cbs, gate, police) are configured through a mix of command BD ring messages and port registers: enetc_port_rd(), enetc_port_wr(). Port registers are a region of the ENETC memory map which are only accessible from the PCIe Physical Function. They are not accessible from the Virtual Functions. Moreover, attempting to access these registers crashes the kernel: $ echo 1 > /sys/bus/pci/devices/0000\:00\:00.0/sriov_numvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15 fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002) fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0 $ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 Unable to handle kernel paging request at virtual address ffff800009551a08 Internal error: Oops: 96000007 [#1] PREEMPT SMP pc : enetc_setup_tc_taprio+0x170/0x47c lr : enetc_setup_tc_taprio+0x16c/0x47c Call trace: enetc_setup_tc_taprio+0x170/0x47c enetc_setup_tc+0x38/0x2dc taprio_change+0x43c/0x970 taprio_init+0x188/0x1e0 qdisc_create+0x114/0x470 tc_modify_qdisc+0x1fc/0x6c0 rtnetlink_rcv_msg+0x12c/0x390 Split enetc_setup_tc() into separate functions for the PF and for the VF drivers. Also remove enetc_qos.o from being included into enetc-vf.ko, since it serves absolutely no purpose there.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash bug in the ENETC network driver. When TSN traffic-control features are offloaded on a virtual function, the driver can touch physical-function-only registers and crash the kernel. Business impact is mainly availability on affected systems using ENETC SR-IOV networking.

Executive priority

Treat this as a targeted availability issue, not a broad internet-facing emergency. Prioritize patching where ENETC SR-IOV virtual functions are used in production, especially telecom, industrial, or edge systems relying on time-sensitive networking.

Technical view

ENETC TSN features such as taprio, cbs, gate, and police use command descriptors plus port registers. Virtual functions cannot access those port registers. The fix separates PF and VF traffic-control setup and removes ENETC QoS code from the VF driver so VF offload is denied instead of crashing.

Likely exposure

Exposure appears limited to Linux systems using the ENETC driver with SR-IOV virtual functions and tc-based TSN offload. General Linux servers without this hardware, driver path, or VF configuration are unlikely to be exposed based on the provided sources.

Exploitation context

The source demonstrates a kernel oops when configuring taprio on an ENETC virtual function. There is no KEV listing and no cited evidence of active exploitation. The described path appears configuration-driven and local to systems where traffic-control changes can be applied.

Researcher notes

The CVE data has no CVSS, CWE, or detailed exploitability rating. The affected-version data is sparse and should be mapped through distro or vendor kernel advisories. The core security boundary issue is VF driver access to PF-only ENETC port register logic.

Mitigation direction

  • Apply a vendor or stable Linux kernel update containing the referenced ENETC fixes.
  • Until patched, avoid tc-based TSN offload on ENETC virtual functions.
  • Review vendor kernel advisories for downstream package names and fixed versions.
  • Restrict who can change traffic-control settings on affected hosts.

Validation and detection

  • Inventory Linux hosts using ENETC networking with SR-IOV virtual functions enabled.
  • Confirm the running kernel includes one of the referenced stable fixes or a vendor backport.
  • Check change history for TSN offload use on ENETC virtual functions.
  • Review kernel logs for ENETC-related oops events during traffic-control configuration.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48645 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux34c6adf1977b611fca3b824ad12a2a415e1e420e, 34c6adf1977b611fca3b824ad12a2a415e1e420e, 34c6adf1977b611fca3b824ad12a2a415e1e420eunaffected
LinuxLinux5.5, 0, 5.15.71, 5.19.12, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.