CVE-2022-48779

What it actually does

Use-after-free in ocelot_vlan_del() where ocelot_vlan_member_del() frees struct ocelot_bridge_vlan while the port's pvid_vlan pointer is still accessed afterward, allowing reference to freed memory.

Why it matters to the business

Kernel memory corruption on systems using MSCC Ocelot Ethernet switches can cause crashes, denial of service, or potential privilege escalation; widespread Linux kernel exposure increases operational risk for network infrastructure.

How an attack unfolds

An attacker with local or network access to manipulate VLAN membership on an Ocelot port triggers the deletion path, causing the freed structure to be dereferenced and enabling memory corruption or crash.

How to fix it

Update to a kernel containing commit c98bed60cdd7f22237ae256cc9c1c3087206b8a2 or later; apply the stable backport for the running kernel series and reboot affected systems.

How to confirm the fix worked

Verify the running kernel includes commit c98bed60cdd7f22237ae256cc9c1c3087206b8a2 via git log or kernel version string; confirm ocelot_vlan_del() logic checks pvid_vlan before the delete call.

Typical attack path

1. Identify systems running vulnerable Linux kernel with MSCC Ocelot driver enabled
2. Obtain privileges sufficient to manage VLAN configuration on the affected port
3. Issue ocelot_vlan_member_del() call that matches the current pvid_vlan
4. Trigger subsequent access to the now-freed ocelot_bridge_vlan structure

How to detect it

Inspect kernel logs for oops or panic messages referencing ocelot_vlan_del or ocelot_bridge_vlan; correlate with VLAN deletion events in system audit logs on hosts with the Ocelot driver loaded.

What your security team should do

• Prioritize patching all Linux systems using the Ocelot driver within the next maintenance window
• Monitor vendor kernel updates for the specific commit and schedule reboots
• Restrict VLAN configuration privileges to trusted processes until patches are applied
• Review network device configurations to minimize unnecessary VLAN operations on Ocelot hardware