CVE-2022-48746

What it actually does

Missing validation that a VF representor belongs to the same physical device as the bond triggers a NULL pointer dereference in mlx5e_is_uplink_rep during netdevice notifier processing.

Why it matters to the business

Systems using Mellanox MLX5 adapters with Linux bonding experience kernel crashes and service outages; the issue has been public for over two years with no known active exploitation or ransomware use.

How an attack unfolds

An attacker with local or network access that can influence bonding state changes on an affected MLX5 host causes the bond_mii_monitor workqueue to invoke the flawed netevent handler, dereferencing uninitialized private data and crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit a01ee1b8165f4161459b5ec4e728bc7130fe8cd4 or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit a01ee1b8165f4161459b5ec4e728bc7130fe8cd4; reproduce bond netevents in a test environment and verify absence of the NULL dereference oops.

Typical attack path

1. Attach MLX5 VF representors to a Linux bonding interface
2. Trigger netdevice state changes via link flaps or administrative commands
3. Bonding module schedules bond_mii_monitor work
4. mlx5e_rep_esw_bond_netevent is called without the same-physdev check
5. mlx5e_is_uplink_rep dereferences a NULL pointer and panics

How to detect it

Search kernel logs for the oops signature containing mlx5e_is_uplink_rep, mlx5e_rep_is_lag_netdev, and bond_mii_monitor; correlate with workqueue activity on bond interfaces.

• mlx5e_is_uplink_rep+0xc/0x50 [mlx5_core]
• BUG: kernel NULL pointer dereference, address: 000000000000036c
• Workqueue: eth.*bond.* bond_mii_monitor [bonding]
• mlx5e_rep_esw_bond_netevent

What your security team should do

• Apply the referenced kernel commit immediately on all MLX5-based hosts using bonding
• Monitor vendor kernel updates for backports to distribution releases
• Test bonding failover behavior after patching to ensure no regression