LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50047: net: dsa: mv88e6060: prevent crash on an unused port

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6060: prevent crash on an unused port If the port isn't a CPU port nor a user port, 'cpu_dp' is a null pointer and a crash happened on dereferencing it in mv88e6060_setup_port(): [ 9.575872] Unable to handle kernel NULL pointer dereference at virtual address 00000014 ... [ 9.942216] mv88e6060_setup from dsa_register_switch+0x814/0xe84 [ 9.948616] dsa_register_switch from mdio_probe+0x2c/0x54 [ 9.954433] mdio_probe from really_probe.part.0+0x98/0x2a0 [ 9.960375] really_probe.part.0 from driver_probe_device+0x30/0x10c [ 9.967029] driver_probe_device from __device_attach_driver+0xb8/0x13c [ 9.973946] __device_attach_driver from bus_for_each_drv+0x90/0xe0 [ 9.980509] bus_for_each_drv from __device_attach+0x110/0x184 [ 9.986632] __device_attach from bus_probe_device+0x8c/0x94 [ 9.992577] bus_probe_device from deferred_probe_work_func+0x78/0xa8 [ 9.999311] deferred_probe_work_func from process_one_work+0x290/0x73c [ 10.006292] process_one_work from worker_thread+0x30/0x4b8 [ 10.012155] worker_thread from kthread+0xd4/0x10c [ 10.017238] kthread from ret_from_fork+0x14/0x3c

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash systems using the Marvell mv88e6060 DSA switch driver when an unused switch port is processed. The known impact is availability: affected embedded or network devices may fail during driver setup or boot. The source bundle does not show remote exploitation or data compromise.

Executive priority

Handle through normal kernel maintenance unless affected appliances are unstable or business-critical. Escalate priority for network devices that fail to boot, lose availability, or cannot be updated quickly.

Technical view

The mv88e6060_setup_port() path dereferenced cpu_dp when the port was neither a CPU port nor a user port. In that topology, cpu_dp could be NULL, causing a kernel NULL pointer dereference during DSA switch registration and MDIO probe. Stable kernel commits are listed as fixes.

Likely exposure

Exposure appears narrow: Linux systems using the mv88e6060 DSA switch driver with an unused non-CPU, non-user port. General Linux servers without this driver and topology are unlikely to be affected based on the provided evidence.

Exploitation context

No active exploitation is reported in the source bundle, and the KEV flag is false. The evidence describes a crash during kernel device probing rather than an attacker-driven path. Treat exploitability as unproven from the supplied sources.

Researcher notes

The source evidence is limited to the CVE record and upstream stable commit references. No CVSS, CWE, exploit report, or detailed affected range semantics are provided. Analysis should avoid assuming attacker control without additional vendor or kernel maintainer evidence.

Mitigation direction

  • Identify systems using the Linux mv88e6060 DSA switch driver.
  • Prioritize embedded and network appliances with affected kernel versions.
  • Apply vendor or upstream stable kernel updates containing the listed fixes.
  • Check vendor advisories before making topology or device-tree changes.
  • Monitor affected devices for boot-time kernel NULL dereference crashes.

Validation and detection

  • Inventory kernel versions against the affected version data in the CVE bundle.
  • Check whether mv88e6060 support is built or loaded on target devices.
  • Review device tree or platform configuration for unused switch ports.
  • Confirm installed kernel includes one of the referenced stable fixes.
  • Look for boot logs matching mv88e6060_setup_port NULL dereference symptoms.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50047 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0abfd494deefdbab66ac03c1181a614285e7d90c, 0abfd494deefdbab66ac03c1181a614285e7d90c, 0abfd494deefdbab66ac03c1181a614285e7d90c, 0abfd494deefdbab66ac03c1181a614285e7d90c, 0abfd494deefdbab66ac03c1181a614285e7d90cunaffected
LinuxLinux4.15, 0, 5.4.211, 5.10.138, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.