GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48779 (GCVE-0-2022-48779)

Vulnerability from cvelistv5 – Published: 2024-07-16 11:13 – Updated: 2026-08-05 08:52
VLAI
Title
net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del() ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if this is the same as the port's pvid_vlan which we access afterwards, what we're accessing is freed memory. Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior to calling ocelot_vlan_member_del().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d4004422f6f9fa8e55c04482008c1c9f9edd2d19 , < c98bed60cdd7f22237ae256cc9c1c3087206b8a2 (git)
Affected: d4004422f6f9fa8e55c04482008c1c9f9edd2d19 , < ef57640575406f57f5b3393cf57f457b0ace837e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 5.16.11 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:00:24.152483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:17.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mscc/ocelot.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c98bed60cdd7f22237ae256cc9c1c3087206b8a2",
              "status": "affected",
              "version": "d4004422f6f9fa8e55c04482008c1c9f9edd2d19",
              "versionType": "git"
            },
            {
              "lessThan": "ef57640575406f57f5b3393cf57f457b0ace837e",
              "status": "affected",
              "version": "d4004422f6f9fa8e55c04482008c1c9f9edd2d19",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mscc/ocelot.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: fix use-after-free in ocelot_vlan_del()\n\nocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if\nthis is the same as the port\u0027s pvid_vlan which we access afterwards,\nwhat we\u0027re accessing is freed memory.\n\nFix the bug by determining whether to clear ocelot_port-\u003epvid_vlan prior\nto calling ocelot_vlan_member_del()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only through local VLAN configuration (bridge switchdev PORT_VLAN delete or ndo_vlan_rx_kill_vid \u2192 ocelot_vlan_del/felix_vlan_del), not by processing remote or adjacent-link packets.\nAC:L - An attacker who can add then delete a PVID VLAN as the last member deterministically frees struct ocelot_bridge_vlan and then dereferences ocelot_port-\u003epvid_vlan; no attacker-uncontrollable race or external condition is required.\nPR:L - VLAN delete is gated by CAP_NET_ADMIN via netlink_ns_capable in the device\u2019s user_ns; Felix/ocelot ports are not NETIF_F_NETNS_LOCAL, so a delegated port in a user-namespace-owned netns yields NET_ADMIN without init-namespace root (same model as CVE-2022-49141/CVE-2026-22982).\nUI:N - The attacker performs the bridge/8021q VLAN delete themselves; no separate victim action is required.\nS:U - This is a standard in-kernel heap use-after-free within the host OS authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - ocelot_vlan_member_del() frees the ocelot_bridge_vlan while pvid_vlan still points at it, so the subsequent vid read (and later ocelot_port_set_pvid uses of a dangling pointer) is a classic UAF enabling arbitrary kernel read via heap reuse.\nI:H - The dangling pvid_vlan pointer can persist when freed memory is reused with a non-matching vid, and later reads of attacker-controlled object contents influence kernel/hardware VLAN state, yielding standard UAF write/control-flow primitives under heap spraying.\nA:H - Use-after-free of the VLAN object can oops/panic the kernel even without a full exploit, so availability impact is High per UAF guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:13.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e"
        }
      ],
      "title": "net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48779",
    "datePublished": "2024-07-16T11:13:17.173Z",
    "dateReserved": "2024-06-20T11:09:39.062Z",
    "dateUpdated": "2026-08-05T08:52:13.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48779",
      "date": "2026-09-15",
      "epss": "0.00218",
      "percentile": "0.12387"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"5.16.11\", \"matchCriteriaId\": \"0D327234-5D4A-43DC-A6DF-BCA0CEBEC039\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mscc: ocelot: fix use-after-free in ocelot_vlan_del()\\n\\nocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if\\nthis is the same as the port\u0027s pvid_vlan which we access afterwards,\\nwhat we\u0027re accessing is freed memory.\\n\\nFix the bug by determining whether to clear ocelot_port-\u003epvid_vlan prior\\nto calling ocelot_vlan_member_del().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net: mscc: ocelot: fix use-after-free en ocelot_vlan_del() ocelot_vlan_member_del() liberar\\u00e1 la estructura ocelot_bridge_vlan, por lo que si es la misma que la pvid_vlan del puerto al que accedemos despu\\u00e9s, a lo que accedemos es a la memoria liberada. Corrija el error determinando si se debe borrar ocelot_port-\u0026gt;pvid_vlan antes de llamar a ocelot_vlan_member_del().\"}]",
      "id": "CVE-2022-48779",
      "lastModified": "2024-11-21T07:34:00.403",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-07-16T12:15:03.077",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48779\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T12:15:03.077\",\"lastModified\":\"2026-08-04T10:17:20.330\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mscc: ocelot: fix use-after-free in ocelot_vlan_del()\\n\\nocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if\\nthis is the same as the port\u0027s pvid_vlan which we access afterwards,\\nwhat we\u0027re accessing is freed memory.\\n\\nFix the bug by determining whether to clear ocelot_port-\u003epvid_vlan prior\\nto calling ocelot_vlan_member_del().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: net: mscc: ocelot: fix use-after-free en ocelot_vlan_del() ocelot_vlan_member_del() liberar\u00e1 la estructura ocelot_bridge_vlan, por lo que si es la misma que la pvid_vlan del puerto al que accedemos despu\u00e9s, a lo que accedemos es a la memoria liberada. Corrija el error determinando si se debe borrar ocelot_port-\u0026gt;pvid_vlan antes de llamar a ocelot_vlan_member_del().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mscc/ocelot.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d4004422f6f9fa8e55c04482008c1c9f9edd2d19\",\"lessThan\":\"c98bed60cdd7f22237ae256cc9c1c3087206b8a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4004422f6f9fa8e55c04482008c1c9f9edd2d19\",\"lessThan\":\"ef57640575406f57f5b3393cf57f457b0ace837e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mscc/ocelot.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.11\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:00:24.152483Z\",\"id\":\"CVE-2022-48779\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.11\",\"matchCriteriaId\":\"0D327234-5D4A-43DC-A6DF-BCA0CEBEC039\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:46:44+00:00",
      "cve": "CVE-2022-48779",
      "id": "CVE-2022-48779",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48779.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T17:19:44Z",
      "cve": "CVE-2022-48779",
      "id": "CVE-2022-48779",
      "initial_release_date": "2024-07-17T04:19:25Z",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48779",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48779.json",
      "version": "16"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.867Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48779\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:00:24.152483Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.797Z\"}}], \"cna\": {\"title\": \"net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is reached only through local VLAN configuration (bridge switchdev PORT_VLAN delete or ndo_vlan_rx_kill_vid \\u2192 ocelot_vlan_del/felix_vlan_del), not by processing remote or adjacent-link packets.\\nAC:L - An attacker who can add then delete a PVID VLAN as the last member deterministically frees struct ocelot_bridge_vlan and then dereferences ocelot_port-\u003epvid_vlan; no attacker-uncontrollable race or external condition is required.\\nPR:L - VLAN delete is gated by CAP_NET_ADMIN via netlink_ns_capable in the device\\u2019s user_ns; Felix/ocelot ports are not NETIF_F_NETNS_LOCAL, so a delegated port in a user-namespace-owned netns yields NET_ADMIN without init-namespace root (same model as CVE-2022-49141/CVE-2026-22982).\\nUI:N - The attacker performs the bridge/8021q VLAN delete themselves; no separate victim action is required.\\nS:U - This is a standard in-kernel heap use-after-free within the host OS authority and does not cross a VM, IOMMU, or other security boundary.\\nC:H - ocelot_vlan_member_del() frees the ocelot_bridge_vlan while pvid_vlan still points at it, so the subsequent vid read (and later ocelot_port_set_pvid uses of a dangling pointer) is a classic UAF enabling arbitrary kernel read via heap reuse.\\nI:H - The dangling pvid_vlan pointer can persist when freed memory is reused with a non-matching vid, and later reads of attacker-controlled object contents influence kernel/hardware VLAN state, yielding standard UAF write/control-flow primitives under heap spraying.\\nA:H - Use-after-free of the VLAN object can oops/panic the kernel even without a full exploit, so availability impact is High per UAF guidance.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d4004422f6f9fa8e55c04482008c1c9f9edd2d19\", \"lessThan\": \"c98bed60cdd7f22237ae256cc9c1c3087206b8a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d4004422f6f9fa8e55c04482008c1c9f9edd2d19\", \"lessThan\": \"ef57640575406f57f5b3393cf57f457b0ace837e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mscc/ocelot.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.16.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mscc/ocelot.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c98bed60cdd7f22237ae256cc9c1c3087206b8a2\"}, {\"url\": \"https://git.kernel.org/stable/c/ef57640575406f57f5b3393cf57f457b0ace837e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mscc: ocelot: fix use-after-free in ocelot_vlan_del()\\n\\nocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if\\nthis is the same as the port\u0027s pvid_vlan which we access afterwards,\\nwhat we\u0027re accessing is freed memory.\\n\\nFix the bug by determining whether to clear ocelot_port-\u003epvid_vlan prior\\nto calling ocelot_vlan_member_del().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.11\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:13.141Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48779\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:13.141Z\", \"dateReserved\": \"2024-06-20T11:09:39.062Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T11:13:17.173Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.