Security readout for executives and security teams
Plain-English summary
This is a Linux kernel network-driver flaw that can crash or disrupt systems using the sfc Ethernet driver under a specific legacy interrupt configuration. The source describes failure during outbound traffic, leading to warnings and a NULL pointer dereference. Evidence points to availability risk, not data theft or remote code execution.
Executive priority
Treat this as a targeted availability issue. It is most urgent for production Linux servers that rely on affected sfc network interfaces, especially where a kernel crash would interrupt revenue, operations, or security monitoring.
Technical view
The sfc driver used an incorrect TX channel offset in legacy interrupt mode when separate TX channels were disabled. Transmit traffic could access an uninitialized channel and hit efx_hard_start_xmit warnings followed by a kernel NULL pointer dereference. The issue is resolved by referenced Linux stable commits.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the sfc Ethernet driver and the described legacy interrupt configuration. General Linux hosts without this driver or configuration are not clearly exposed based on the supplied sources.
Exploitation context
CISA KEV is false in the bundle, and no cited source claims active exploitation. The described trigger is sending traffic through the affected driver path; the available evidence supports denial-of-service style impact rather than compromise.
Researcher notes
The public record lacks CVSS, CWE, and detailed distribution matrices. Analysis should stay tied to the driver path, affected kernel branches, and stable commits. Do not generalize this to all Linux networking or claim exploitation without new evidence.
Mitigation direction
- Apply a vendor kernel update containing the referenced Linux stable sfc fix.
- Prioritize systems using the sfc Ethernet driver or Solarflare-class NICs.
- Check distribution advisories for backported fixes matching your kernel branch.
- If patching is delayed, seek vendor guidance for configuration-specific workarounds.
Validation and detection
- Inventory hosts loading the sfc driver and compare kernel versions to vendor advisories.
- Review logs for efx_hard_start_xmit warnings or NULL pointer dereference traces.
- Confirm patched kernels include one of the referenced stable commits or vendor backport.
- Test outbound network traffic after patching on representative affected hardware.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48647 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b4afd3878f961d3517f27b3213730fceef77945cCVE reference, Linux
- https://git.kernel.org/stable/c/360910b88d1466a90644a4e0533803b594344a2bCVE reference, Linux
- https://git.kernel.org/stable/c/5f623a77cfc2d501d72bcb4f9ee71721e6c766ffCVE reference, Linux
- https://git.kernel.org/stable/c/f232af4295653afa4ade3230462b3be15ad16419CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.