CVE-2022-49025

What it actually does

Use-after-free in net/mlx5e termination table handling: failure to reset attr->dests[num_vport_dests].termtbl to NULL after revert on subsequent dest failure leaves a dangling pointer that is dereferenced on rule release.

Why it matters to the business

Kernel memory corruption on systems using mlx5e networking can cause crashes, data leaks, or remote code execution, leading to denial of service, loss of network connectivity, and potential full system compromise; high prevalence in Linux environments amplifies exposure.

How an attack unfolds

Attacker configures multiple destinations involving termination tables so that the second or later destination fails during setup; the driver reverts table usage but omits clearing the termtbl pointer; later rule release triggers the use-after-free, which can be leveraged for arbitrary code execution. Threat actors in 2024 zero-day campaigns and Linux kernel exploit groups have targeted similar kernel flaws.

How to fix it

Update to a kernel containing commit c75027686e3a5392e2a233a096ef04412aa93e7e (or equivalent upstream fix for mlx5e termtbl reset); apply vendor backports immediately given the 726-day window since publication and ongoing kernel exploitation activity.

How to confirm the fix worked

Confirm the fix by inspecting the mlx5e source for the termtbl=NULL assignment after revert; test multi-destination rule creation with intentional secondary failures and verify no dangling pointer on rule release; scan for the published commit hash in the running kernel tree.

Typical attack path

1. Identify hosts with mlx5e driver and termination table usage
2. Trigger multi-destination rule creation where a later destination fails
3. Force revert path without termtbl reset
4. Trigger rule release to dereference freed memory
5. Escalate the use-after-free into code execution or crash

How to detect it

Search kernel logs for mlx5e termtbl-related warnings or oops messages around rule creation failures; inspect auditd or eBPF traces for unusual termination table operations; review dmesg for use-after-free stack traces involving mlx5e; correlate with network configuration changes from threat actor TTPs listed in recent Linux kernel campaigns.

• mlx5e.*termination table
• attr->dests.*termtbl
• use-after-free.*mlx5e
• revert.*term tables

What your security team should do

• Prioritize patching all Linux systems with mlx5e hardware within the next 48 hours
• Monitor EPSS and threat actor reports for any increase in exploitation attempts
• Restrict untrusted network configurations that exercise termination tables until patched
• Enable kernel hardening features such as KASAN and memory tagging where available