Vulnerability in Linux

CVE-2022-48720

In the Linux kernel, the following vulnerability has been resolved: net: macsec: Fix offload support for NETDEV_UNREGISTER event Current macsec netdev notify handler handles NETDEV_UNREGISTER event by releasing relevant SW resources only, this causes resources leak in case of macsec HW offload, as the underlay driver was not notified to clean it's macsec offload resources. Fix by calling the underlay driver to clean it's relevant resources by moving offload handling from macsec_dellink() to macsec_common_dellink() when handling NETDEV_UNREGISTER event.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (12.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-48720: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

  • Linux — versions 3cf3227a21d1fb020fe26128e60321bd2151e922, 5.6, 0
  • Linux Kernel — versions 5.17

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2022-48720?
CVE-2022-48720 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2024-06-20.
How severe is CVE-2022-48720?
High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2022-48720 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.