LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50063: net: dsa: felix: suppress non-changes to the tagging protocol

In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: suppress non-changes to the tagging protocol The way in which dsa_tree_change_tag_proto() works is that when dsa_tree_notify() fails, it doesn't know whether the operation failed mid way in a multi-switch tree, or it failed for a single-switch tree. So even though drivers need to fail cleanly in ds->ops->change_tag_protocol(), DSA will still call dsa_tree_notify() again, to restore the old tag protocol for potential switches in the tree where the change did succeeed (before failing for others). This means for the felix driver that if we report an error in felix_change_tag_protocol(), we'll get another call where proto_ops == old_proto_ops. If we proceed to act upon that, we may do unexpected things. For example, we will call dsa_tag_8021q_register() twice in a row, without any dsa_tag_8021q_unregister() in between. Then we will actually call dsa_tag_8021q_unregister() via old_proto_ops->teardown, which (if it manages to run at all, after walking through corrupted data structures) will leave the ports inoperational anyway. The bug can be readily reproduced if we force an error while in tag_8021q mode; this crashes the kernel. echo ocelot-8021q > /sys/class/net/eno2/dsa/tagging echo edsa > /sys/class/net/eno2/dsa/tagging # -EPROTONOSUPPORT Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014 Call trace: vcap_entry_get+0x24/0x124 ocelot_vcap_filter_del+0x198/0x270 felix_tag_8021q_vlan_del+0xd4/0x21c dsa_switch_tag_8021q_vlan_del+0x168/0x2cc dsa_switch_event+0x68/0x1170 dsa_tree_notify+0x14/0x34 dsa_port_tag_8021q_vlan_del+0x84/0x110 dsa_tag_8021q_unregister+0x15c/0x1c0 felix_tag_8021q_teardown+0x16c/0x180 felix_change_tag_protocol+0x1bc/0x230 dsa_switch_event+0x14c/0x1170 dsa_tree_change_tag_proto+0x118/0x1c0

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50063 is a Linux kernel crash bug in the DSA Felix network switch driver. Under specific tag-protocol change failure conditions, cleanup can run incorrectly and corrupt driver state, causing a kernel NULL pointer dereference. Business impact is likely availability disruption on systems using the affected driver path.

Executive priority

Treat as a targeted availability risk, not a broad enterprise emergency. Patch affected network appliances or embedded Linux systems promptly, especially where kernel crashes would interrupt production connectivity.

Technical view

The DSA tag protocol rollback path can call the Felix driver again with unchanged protocol operations after a failed change. Acting on this non-change can double-register or wrongly tear down tag_8021q state, corrupting structures and crashing the kernel. The CVE lists Linux 5.19-era versions as affected and references stable kernel fixes.

Likely exposure

Exposure appears limited to Linux systems using the DSA Felix/Ocelot switch driver and tag protocol changes. Ordinary Linux hosts without that hardware, driver, or operational path are unlikely to be exposed based on the provided sources.

Exploitation context

The bundle does not show active exploitation and KEV is false. The cited description demonstrates a reproducible local kernel crash scenario, but does not establish remote exploitability, privilege requirements, or broad weaponization.

Researcher notes

The key condition is a failed DSA tag protocol change followed by rollback notification where proto_ops equals old_proto_ops. The fix suppresses non-changes in the Felix path. Source evidence is strong for crash behavior, but incomplete for CVSS, privilege boundary, and exploit maturity.

Mitigation direction

  • Update to a kernel or vendor build containing the referenced stable fixes.
  • Check Linux distribution advisories for patched package versions.
  • Prioritize systems using Felix/Ocelot DSA switch functionality.
  • Avoid unsupported tag protocol changes until patched, where operationally feasible.

Validation and detection

  • Identify systems running affected Linux 5.19-era kernels.
  • Confirm whether Felix/Ocelot DSA switch drivers are present and used.
  • Verify vendor kernel changelogs include the referenced fixes.
  • Review crash logs for matching DSA Felix tag_8021q call traces.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50063 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7a29d220f4c0745a6d435dbd53c659fbde4998b6, 7a29d220f4c0745a6d435dbd53c659fbde4998b6unaffected
LinuxLinux5.19, 0, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.