CVE-2022-49134 mlxsw: spectrum: Guard against invalid local ports
A NULL pointer dereference in the mlxsw spectrum driver allows attackers to cause a denial of service via crafted firmware events.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49134?
CVE-2022-49134 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum: Guard against invalid local ports
When processing events generated by the device's firmware, the driver protects itself from events reported for non-existent local ports, but not for the CPU port (local port 0), which exists, but does not have all the fields as any local port.
This can result in a NULL pointer dereference when trying access 'struct mlxsw_sp_port' fields which are not initialized for CPU port.
Commit 63b08b1f6834 ("mlxsw: spectrum: Protect driver from buggy firmware") already handled such issue by bailing early when processing a PUDE event reported for the CPU port.
Generalize the approach by moving the check to a common function and making use of it in all relevant places.
Weakness: CWE-476
Which versions are affected by CVE-2022-49134?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49134?
Apply the vendor's patch.
Is CVE-2022-49134 being exploited?
There is no known exploitation of CVE-2022-49134 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-58575, DEBIAN-CVE-2022-49134, GHSA-rxrv-jjf7-ph47, ROOT-OS-DEBIAN-11-CVE-2022-49134, ROOT-OS-UBUNTU-2204-CVE-2022-49134, UBUNTU-CVE-2022-49134.