LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48779: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del() ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if this is the same as the port's pvid_vlan which we access afterwards, what we're accessing is freed memory. Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior to calling ocelot_vlan_member_del().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-safety bug in the Ocelot Ethernet switch driver. Under specific VLAN deletion conditions, the kernel may access memory after it was freed. The sources do not provide CVSS, impact detail, or evidence of active exploitation.

Executive priority

Treat as a targeted kernel maintenance item, not an internet-wide emergency based on current evidence. Prioritize network appliances or embedded Linux platforms using Ocelot switching features, and fold remediation into normal kernel update governance.

Technical view

In ocelot_vlan_del(), ocelot_vlan_member_del() can free struct ocelot_bridge_vlan. If that object is also ocelot_port->pvid_vlan, later access becomes use-after-free. The fix determines whether pvid_vlan must be cleared before calling the freeing function.

Likely exposure

Likely exposure is limited to Linux systems running affected 5.16-era kernels with the mscc Ocelot switch driver and relevant bridge VLAN operations. Generic Linux servers not using this driver are less likely to be exposed, based on the provided sources.

Exploitation context

The bundle marks CISA KEV as false and provides no public exploit evidence. The source material does not state whether exploitation requires local privileges, network access, or specific administrative VLAN operations, so exploitability should be treated as not established.

Researcher notes

The public record is sparse: no CVSS, CWE, exploitation details, or full impact statement are provided. Analysis should stay close to the kernel fix: a use-after-free caused by object lifetime handling during Ocelot VLAN deletion.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced stable fix.
  • Check Linux distribution or appliance vendor advisories for backported patches.
  • Prioritize systems using the mscc Ocelot driver with bridge VLAN configuration.
  • If patch timing is constrained, reduce unnecessary VLAN change activity until maintenance.

Validation and detection

  • Inventory kernels against the affected 5.16 to pre-5.16.11 range described in sources.
  • Confirm the kernel includes commit c98bed60cdd7 or ef5764057540, or a vendor backport.
  • Identify systems using Ocelot switch hardware and bridge VLAN features.
  • Review vendor release notes for CVE-2022-48779 coverage.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48779 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd4004422f6f9fa8e55c04482008c1c9f9edd2d19, d4004422f6f9fa8e55c04482008c1c9f9edd2d19unaffected
LinuxLinux5.16, 0, 5.16.11, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.