LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48648: sfc: fix null pointer dereference in efx_hard_start_xmit

In the Linux kernel, the following vulnerability has been resolved: sfc: fix null pointer dereference in efx_hard_start_xmit Trying to get the channel from the tx_queue variable here is wrong because we can only be here if tx_queue is NULL, so we shouldn't dereference it. As the above comment in the code says, this is very unlikely to happen, but it's wrong anyway so let's fix it. I hit this issue because of a different bug that caused tx_queue to be NULL. If that happens, this is the error message that we get here: BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [...] RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-48648 is a Linux kernel flaw in the sfc network driver. Under an unusual error condition, the driver can dereference a null transmit queue pointer and crash the kernel. The source describes this as very unlikely and triggered while investigating a separate bug.

Executive priority

Treat as a targeted stability risk, not an emergency internet-wide exposure based on current evidence. Patch through normal kernel maintenance, with higher priority for systems using the sfc driver in production network paths.

Technical view

The issue is a NULL pointer dereference in efx_hard_start_xmit in the Linux sfc driver. The vulnerable code tried to derive a channel from tx_queue even though control flow only reached that point when tx_queue was NULL. Stable kernel commits correct that logic.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel builds with the sfc driver present or active. The bundle lists Linux kernel versions including 5.10, 5.10.146, 5.15.71, 5.19.12, and 6.0 as affected, but does not provide distribution package mappings.

Exploitation context

No active exploitation is stated in the provided sources, and the CVE is not marked KEV. The source describes the condition as very unlikely and observed because another bug caused tx_queue to become NULL. Impact evidence supports kernel crash risk, not code execution.

Researcher notes

The public record lacks CVSS, CWE, exploit details, and distribution-specific fixed versions. Analysis should stay close to the upstream fix: a defensive correction around tx_queue handling in efx_hard_start_xmit after NULL state is detected.

Mitigation direction

  • Apply vendor Linux kernel updates containing the referenced sfc stable fixes.
  • Check Linux distribution advisories for exact fixed package versions.
  • Prioritize systems where the sfc driver is loaded or required.
  • Plan maintenance carefully because kernel updates usually require rebooting.

Validation and detection

  • Inventory kernel versions on Linux hosts against vendor advisories.
  • Identify hosts with the sfc driver present or loaded.
  • Review kernel logs for NULL pointer crashes in efx_hard_start_xmit.
  • Confirm installed kernel includes one of the referenced stable fixes.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48648 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux12804793b17c0e19115a90d98f2f3df0cb79e233, 12804793b17c0e19115a90d98f2f3df0cb79e233, 12804793b17c0e19115a90d98f2f3df0cb79e233, 12804793b17c0e19115a90d98f2f3df0cb79e233unaffected
LinuxLinux5.10, 0, 5.10.146, 5.15.71, 5.19.12, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.