LiveActive security incident?Get immediate response
CVE Record

CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface under a lag Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag") fixed a similar issue in the lan966x driver caused by a NULL pointer dereference. The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic and is susceptible to the same crash. This issue specifically affects the ocelot_vsc7514.c frontend, which leaves unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as it uses the DSA framework which registers all ports. Fix this by checking if the port pointer is valid before accessing it.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

A Linux network-driver flaw can crash affected systems when an interface is added beneath a link aggregation group. Exposure appears limited to systems using the Ocelot VSC7514 frontend; the Felix VSC9959 frontend is explicitly unaffected. The documented impact is availability loss, but severity and broader security consequences are not established.

Executive priority

Prioritize affected network appliances according to availability criticality. Immediate emergency action is not justified by the supplied evidence alone because severity, attack path, and exploitation are unknown. Systems using Ocelot VSC7514 in critical paths should receive accelerated vendor-supported updates and controlled validation.

Technical view

ocelot_set_aggr_pgids() can dereference a NULL pointer because ocelot_vsc7514.c represents unused ports as NULL. The vulnerable path occurs while adding an interface under a LAG. The kernel fix validates the port pointer before access. felix_vsc9959.c registers all ports through DSA and is not affected by this condition.

Likely exposure

Likely exposure is confined to Linux systems using the Ocelot VSC7514 frontend and performing the relevant interface-under-LAG operation. The bundle identifies affected Linux versions including 5.12, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, and 6.19. Product-specific exposure requires vendor confirmation.

Exploitation context

No active exploitation is established: the record is not flagged in KEV, and the supplied sources provide no exploitation reports. Evidence supports a NULL-pointer crash and resulting availability impact. The bundle does not establish remote reachability, required privileges, reproducibility, or exploitation beyond denial of service.

Researcher notes

The central defect is unsafe iteration or access involving potentially unregistered Ocelot ports. The affected-version data is unusual and should not be treated as complete range semantics without consulting the CVE record and downstream vendor advisories. No CVSS score or CWE is supplied. Siemens publishes a related advisory, but its product applicability is not detailed in this bundle.

Mitigation direction

  • Apply a vendor-supported kernel update containing the applicable cited fix.
  • Check appliance or distribution advisories before mapping upstream versions to deployed products.
  • Restrict unnecessary network-interface and LAG configuration access pending remediation.
  • Schedule remediation promptly where a crash could disrupt critical network availability.

Validation and detection

  • Inventory systems using the Ocelot VSC7514 frontend and record their kernel builds.
  • Confirm whether downstream kernels contain the relevant upstream stable fix.
  • Verify the Felix VSC9959 frontend is excluded from the affected population.
  • Review kernel logs for crashes associated with interface or LAG configuration changes.
  • Validate updated systems through approved, non-production configuration testing.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-22982 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux528d3f190c98c8f7d9581f68db4af021696727b2, 528d3f190c98c8f7d9581f68db4af021696727b2, 528d3f190c98c8f7d9581f68db4af021696727b2, 528d3f190c98c8f7d9581f68db4af021696727b2, 528d3f190c98c8f7d9581f68db4af021696727b2, 528d3f190c98c8f7d9581f68db4af021696727b2unaffected
LinuxLinux5.12, 0, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.