LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48746: net/mlx5e: Fix handling of wrong devices during bond netevent

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix handling of wrong devices during bond netevent Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the VF representor is on the same phys device of the bond handling the netevent. Fix by adding the missing check and optimizing the check if the netdev is VF representor so it will not access uninitialized private data and crashes. BUG: kernel NULL pointer dereference, address: 000000000000036c PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Workqueue: eth3bond0 bond_mii_monitor [bonding] RIP: 0010:mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core] RSP: 0018:ffff88812d69fd60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881cf800000 RCX: 0000000000000000 RDX: ffff88812d69fe10 RSI: 000000000000001b RDI: ffff8881cf800880 RBP: ffff8881cf800000 R08: 00000445cabccf2b R09: 0000000000000008 R10: 0000000000000004 R11: 0000000000000008 R12: ffff88812d69fe10 R13: 00000000fffffffe R14: ffff88820c0f9000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88846fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000036c CR3: 0000000103d80006 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5e_eswitch_uplink_rep+0x31/0x40 [mlx5_core] mlx5e_rep_is_lag_netdev+0x94/0xc0 [mlx5_core] mlx5e_rep_esw_bond_netevent+0xeb/0x3d0 [mlx5_core] raw_notifier_call_chain+0x41/0x60 call_netdevice_notifiers_info+0x34/0x80 netdev_lower_state_changed+0x4e/0xa0 bond_mii_monitor+0x56b/0x640 [bonding] process_one_work+0x1b9/0x390 worker_thread+0x4d/0x3d0 ? rescuer_thread+0x350/0x350 kthread+0x124/0x150 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash systems in a specific networking configuration involving mlx5e, bonding, and VF representor devices. The source evidence shows a kernel NULL pointer dereference, so the main business risk is availability loss, not confirmed data theft or remote code execution.

Executive priority

Treat this as a targeted availability risk. Prioritize patch validation for infrastructure using mlx5e networking and bond configurations, especially production network hosts where a kernel crash could interrupt services.

Technical view

The mlx5e bond netevent handler checked whether a netdev was a VF representor but missed validating that it belonged to the same physical device as the bond. That could access uninitialized private data and trigger a NULL pointer dereference during bond monitoring.

Likely exposure

Exposure is most likely on Linux systems using the mlx5e driver with bonding and VF representor or eswitch-related networking. Generic Linux hosts without this driver and bonding path are less likely to be affected, based on the provided evidence.

Exploitation context

No active exploitation is supported by the source bundle, and the CVE is not listed as KEV. The available evidence describes a crash condition from mishandled bond netevents, with no public exploit status, attacker prerequisites, or remote trigger details provided.

Researcher notes

The source record lacks CVSS, CWE, and detailed affected version ranges beyond Linux kernel version entries and stable commit references. The root issue is missing same-physical-device validation plus unsafe representor checks in the mlx5e bond netevent path.

Mitigation direction

  • Check vendor or distribution kernel advisories for CVE-2022-48746 coverage.
  • Update to a kernel containing the referenced stable fixes.
  • Prioritize systems using mlx5e, bonding, and VF representor configurations.
  • If patching is delayed, review whether affected bonding configurations can be reduced.

Validation and detection

  • Inventory Linux kernels and identify hosts using the mlx5e driver.
  • Check whether bonding and VF representor networking are configured on those hosts.
  • Compare installed kernel packages against vendor-fixed versions or referenced stable commits.
  • Review kernel logs for NULL pointer dereference traces involving mlx5e and bonding.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48746 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7e51891a237f9ea319f53f9beb83afb0077d88e6, 7e51891a237f9ea319f53f9beb83afb0077d88e6, 7e51891a237f9ea319f53f9beb83afb0077d88e6, 7e51891a237f9ea319f53f9beb83afb0077d88e6unaffected
LinuxLinux5.8, 0, 5.10.97, 5.15.20, 5.16.6, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.