CVE-2022-49134
mlxsw: spectrum: Guard against invalid local ports
Published:
2/26/2025
Last updated:
10/1/2025
Reserved:
2/26/2025
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum: Guard against invalid local ports
When processing events generated by the device's firmware, the driver
protects itself from events reported for non-existent local ports, but
not for the CPU port (local port 0), which exists, but does not have all
the fields as any local port.
This can result in a NULL pointer dereference when trying access
'struct mlxsw_sp_port' fields which are not initialized for CPU port.
Commit 63b08b1f6834 ("mlxsw: spectrum: Protect driver from buggy firmware")
already handled such issue by bailing early when processing a PUDE event
reported for the CPU port.
Generalize the approach by moving the check to a common function and
making use of it in all relevant places.
CNA assigner:
Linux (416baaa9-dc9f-4396-8d5f-8c081fb06d67)
Requested by:
n/a
Products affected (4)
| Product |
Vendor |
Version |
| Linux |
Linux
|
< 10.0.19042.1889
|
| Linux |
Linux
|
11.6.1-11.6.5.1
|
| Linux |
Linux
|
SD835
|
| Linux |
Linux
|
2.0.9-hotfix.1
|