CVE-2022-48645

What it actually does

Attempting to configure TSN qdiscs (taprio, cbs, gate, police) on ENETC VF interfaces triggers invalid access to PF-only port registers, causing kernel paging fault and panic in enetc_setup_tc_taprio.

Why it matters to the business

Misapplied network traffic shaping on virtual interfaces can crash the host, producing unplanned downtime and loss of network connectivity for dependent workloads.

How an attack unfolds

An attacker or automated script issues a tc qdisc replace command targeting an ENETC VF device; the VF driver path still invokes PF-only register access, resulting in an unhandled kernel paging request and immediate system crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 510e703e4ed0e011db860bc21228aff48fc9eea7 which splits PF/VF tc setup paths and excludes enetc_qos.o from enetc-vf.ko; apply the update through the distribution's kernel package manager and reboot.

How to confirm the fix worked

Confirm the running kernel contains commit 510e703e4ed0e011db860bc21228aff48fc9eea7 or later; attempt the previously crashing tc qdisc command on a VF and verify it is cleanly rejected instead of panicking; review dmesg for absence of the enetc_setup_tc_taprio paging fault.

Typical attack path

1. Identify or create an ENETC VF interface visible to the attacker
2. Issue tc qdisc replace with taprio or similar TSN offload parameters on the VF
3. Kernel executes enetc_setup_tc_taprio which dereferences inaccessible port registers
4. Page fault triggers Oops and system panic or reboot

How to detect it

Search kernel logs and crash dumps for the string 'Unable to handle kernel paging request' together with 'enetc_setup_tc_taprio'; inspect audit or shell history for tc commands that reference taprio, cbs, gate or police on VF-named interfaces; review dmesg timestamps around any unexpected reboots.

• enetc_setup_tc_taprio+0x170/0x47c
• Unable to handle kernel paging request at virtual address ffff800009551a08
• enetc_setup_tc_taprio
• fsl_enetc_vf
• tc qdisc replace dev.*taprio

What your security team should do

• Prioritize kernel updates on all systems exposing ENETC VFs within the next maintenance window
• Add monitoring for kernel oops messages containing enetc_setup_tc_taprio
• Restrict unprivileged tc qdisc configuration on VF interfaces via policy or SELinux/AppArmor where possible