Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-safety bug in ipvlan packet handling. A local packet-sending path can leave a packet header pointer unset, causing out-of-bounds kernel memory access. The cited CVSS score is 7.7 because integrity and availability impact are high, but the attack vector is local.
Executive priority
Treat as a high-priority kernel maintenance item for Linux infrastructure, especially container or network-heavy hosts. There is no cited active exploitation, so emergency response depends on local exposure and privilege boundaries, but kernel compromise paths can have severe operational impact.
Technical view
When AF_PACKET sends through ipvlan with PACKET_QDISC_BYPASS, packet_direct_xmit() may not reset skb->mac_header. ipvlan_xmit_mode_l2() then uses eth_hdr() against a 65535 mac_header value, triggering slab out-of-bounds access. Kernel stable fixes replace eth_hdr() with skb_eth_hdr() and reset the multicast mac header path.
Likely exposure
Exposure is most plausible on Linux systems using affected kernel versions with ipvlan enabled and local ability to exercise AF_PACKET packet transmission paths. Containers or workloads with packet socket capability may be relevant, but the provided sources do not define exact distribution package exposure.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The described trigger is local and specific: AF_PACKET traffic through ipvlan with PACKET_QDISC_BYPASS. Do not treat this as internet-remote based on the provided evidence.
Researcher notes
Evidence is strongest for root cause and upstream stable fixes. The public description includes KASAN slab-out-of-bounds in ipvlan_xmit_mode_l2 via packet_direct_xmit. Distribution-specific affected ranges, exploitability constraints, and real-world abuse are not established in the provided bundle.
Mitigation direction
- Update Linux kernels using vendor advisories or referenced stable kernel fixes.
- Prioritize hosts using ipvlan, container networking, or packet socket capabilities.
- Review whether workloads can create AF_PACKET sockets or use CAP_NET_RAW.
- Check distribution kernel backport status before assuming version strings are vulnerable.
- Monitor vendor security notices for operational mitigations or package-specific guidance.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and container hosts.
- Identify systems using the ipvlan kernel module or ipvlan-based networking.
- Review container and workload permissions for AF_PACKET or CAP_NET_RAW access.
- Confirm patched status against vendor errata, not only upstream kernel numbers.
- Track remediation evidence in vulnerability management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-48651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H2.55.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e2b46cd5796f083e452fbc624f65b80328b0c1a4CVE reference, Linux
- https://git.kernel.org/stable/c/25efdbe5fe542c3063d1948cc4e98abcb57621caCVE reference, Linux
- https://git.kernel.org/stable/c/bffcdade259c05ab3436b5fab711612093c275efCVE reference, Linux
- https://git.kernel.org/stable/c/346e94aa4a99378592c46d6a34c72703a32bd5beCVE reference, Linux
- https://git.kernel.org/stable/c/ab4a733874ead120691e8038272d22f8444d3638CVE reference, Linux
- https://git.kernel.org/stable/c/8d06006c7eb75587d986da46c48ba9274f94e8e7CVE reference, Linux
- https://git.kernel.org/stable/c/b583e6b25bf9321c91154f6c78d2173ef12c4241CVE reference, Linux
- https://git.kernel.org/stable/c/81225b2ea161af48e093f58e8dfee6d705b16af4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.