CVE-2022-48647

What it actually does

The flaw hardcodes an incorrect TX channel offset in legacy interrupt mode when separate TX channels are disabled, causing the transmit path to dereference an uninitialized channel structure and trigger a NULL pointer dereference during packet transmission.

Why it matters to the business

Systems using the affected Solarflare SFC Ethernet driver may experience immediate kernel crashes and reboots whenever network traffic is sent, leading to denial of service and unplanned downtime on servers or appliances relying on this hardware.

How an attack unfolds

An attacker with the ability to initiate network transmission on a vulnerable interface (via local process, user login, or remote packet that triggers TX) causes the kernel to execute efx_hard_start_xmit on an invalid channel, resulting in a NULL dereference and system panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f or later; rebuild and deploy the updated kernel image on all affected hosts; verify the driver no longer hardcodes tx_channel_offset=1 in legacy mode.

How to confirm the fix worked

Confirm the running kernel contains commit 4b0986a3613c92f4ec1bdc7f60ec66fea135991f; test by generating outbound traffic on the SFC interface under legacy interrupt configuration and verify no WARNING or BUG messages appear in dmesg related to efx_hard_start_xmit.

Typical attack path

1. Identify a Linux system using the SFC driver with legacy interrupts and efx_separate_tx_channels=false
2. Obtain local execution context or trigger outbound network traffic
3. Initiate packet transmission via any socket or interface send path
4. Kernel enters efx_hard_start_xmit with offset=1 against a single-channel setup
5. NULL pointer dereference occurs, producing oops and system halt or reboot

How to detect it

Search kernel logs and dmesg for the strings 'efx_hard_start_xmit' combined with 'WARNING' or 'unable to handle kernel NULL pointer dereference'; inspect crash dumps for RIP values inside the sfc module's transmit path.

• WARNING: CPU:.*PID:.*at drivers/net/ethernet/sfc/tx.c:540 efx_hard_start_xmit
• BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
• RIP: 0010:efx_hard_start_xmit

What your security team should do

• Prioritize kernel upgrade on all systems exposing the SFC driver before the next maintenance window
• Monitor dmesg and kernel logs for efx_hard_start_xmit warnings until patches are applied
• Temporarily disable legacy interrupt mode or enable separate TX channels where hardware permits as a short-term mitigation