Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system when software reads a network device speed value from sysfs while that device is being removed or the system is shutting down. The public record describes a kernel panic, so the main business concern is availability, not data theft.
Executive priority
Treat as a targeted availability risk. Prioritize normal kernel maintenance for exposed Linux fleets, especially infrastructure where unexpected reboots or panics affect service reliability. Escalate only if internal crash evidence appears.
Technical view
The flaw is in net-sysfs speed_show. During netdevice teardown, the code could query ethtool link settings after the device was no longer present, leading to a NULL pointer dereference path and panic. The fix adds a presence check before accessing the device.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions where local software or monitoring agents read network sysfs speed data during interface removal or shutdown. The bundle names Linux kernels and stable kernel fixes, but does not identify specific distributions or packaged kernel builds.
Exploitation context
The source bundle does not report active exploitation, public weaponization, KEV listing, CVSS, or remote reachability. The described scenario involves a race during device shutdown/removal and sysfs access, with observed impact as a kernel panic.
Researcher notes
Evidence supports a kernel NULL dereference/panic in speed_show during netdevice teardown. The bundle does not establish attacker privileges, remote triggerability, CVSS, distribution package status, or exploit availability. Avoid assuming more than availability impact without vendor data.
Mitigation direction
- Identify Linux kernel versions across servers, appliances, and cloud images.
- Check vendor or distribution advisories for backported fixes for CVE-2022-48850.
- Prioritize kernel updates on systems with frequent NIC changes or aggressive monitoring agents.
- Review monitoring that reads network sysfs speed during shutdown or interface removal.
Validation and detection
- Confirm kernel package version against vendor guidance or upstream stable fix levels.
- Check crash logs for panics involving speed_show, ethtool link settings, or mlx5_core teardown.
- Inventory agents that read /sys/class/net device speed attributes.
- Verify updated kernels include the net-sysfs presence check fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48850 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a7b9ab04c5932dee7ec95e0abc58b0df350c0dd2CVE reference, Linux
- https://git.kernel.org/stable/c/081369ad088a76429984483b8a5f7e967a125aadCVE reference, Linux
- https://git.kernel.org/stable/c/75fc8363227a999e8f3d17e2eb28dce5600dcd3fCVE reference, Linux
- https://git.kernel.org/stable/c/8879b5313e9fa5e0c6d6812a0d25d83aed0110e2CVE reference, Linux
- https://git.kernel.org/stable/c/d15c9f6e3335002fea1c33bc8f71a705fa96976cCVE reference, Linux
- https://git.kernel.org/stable/c/8d5e69d8fbf3a35ab4fbe56b8f092802b43f3ef6CVE reference, Linux
- https://git.kernel.org/stable/c/3a79f380b3e10edf6caa9aac90163a5d7a282204CVE reference, Linux
- https://git.kernel.org/stable/c/4224cfd7fb6523f7a9d1c8bb91bb5df1e38eb624CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.