Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can crash systems using Mellanox mlx5 link aggregation when device readiness is tracked incorrectly during PF registration or removal. The evidence points to availability risk, not data theft or privilege escalation. Exposure depends on affected kernels and mlx5 LAG usage.
Executive priority
Treat as targeted availability risk for specialized Linux networking systems. Prioritize infrastructure where mlx5 LAG supports production connectivity, but do not treat it as internet-wide emergency without stronger exploitation evidence.
Technical view
The mlx5 LAG code could set MLX5_LAG_FLAG_NDEVS_READY before both netdevices were registered. A later PF unload could leave the flag set with a null device pointer, causing a kernel null pointer dereference in mlx5_lag_is_multipath during mlx5_do_bond_work.
Likely exposure
Most relevant to Linux hosts with mlx5 hardware or virtualized mlx5 testing environments using LAG or bonding. The bundle lists Linux kernel versions and commit identifiers, but distro backport status is not provided.
Exploitation context
No active exploitation is supported by the bundle, and KEV is false. The described failure was encountered as a kernel oops during device load and unload sequencing, suggesting an availability issue requiring a specific mlx5 LAG state.
Researcher notes
Evidence is limited to the CVE description and kernel stable commits. No CVSS, CWE, exploit status, or distro-specific package mapping is provided. The primary observable is a kernel null pointer dereference in mlx5 LAG readiness handling.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported mlx5 LAG fixes.
- Prioritize affected systems using mlx5 LAG or bonding.
- Track vendor guidance if fixed package names are unclear.
Validation and detection
- Inventory Linux systems using mlx5_core and LAG or bonding.
- Compare running kernels against distro advisories and referenced stable commits.
- Review kernel logs for mlx5_lag_is_multipath null pointer dereferences.
- Confirm patched kernels in staging before broad rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50002 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4c040acf5744e87a7b3490f9ec8bedd0d15c9f29CVE reference, Linux
- https://git.kernel.org/stable/c/a6e675a66175869b7d87c0e1dd0ddf93e04f8098CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.