{"cve":"CVE-2022-48648","nvd":{"published":"2024-04-28T13:15:07.290","modified":"2026-06-17T05:15:49.060","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix null pointer dereference in efx_hard_start_xmit\n\nTrying to get the channel from the tx_queue variable here is wrong\nbecause we can only be here if tx_queue is NULL, so we shouldn't\ndereference it. As the above comment in the code says, this is very\nunlikely to happen, but it's wrong anyway so let's fix it.\n\nI hit this issue because of a different bug that caused tx_queue to be\nNULL. If that happens, this is the error message that we get here:\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n  [...]\n  RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/0a242eb2913a4aa3d6fbdb86559f27628e9466f3","https://git.kernel.org/stable/c/8547c7bfc0617e7184e4da65b9b96681fcfe9998","https://git.kernel.org/stable/c/b3b41d4d95d3822b2e459ecbc80d030ea6aec5e7","https://git.kernel.org/stable/c/b3b952168ee1f220ba729fa100fd9d5aa752eb03","https://git.kernel.org/stable/c/0a242eb2913a4aa3d6fbdb86559f27628e9466f3"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:49:08.435428910+00:00"},"epss":{"cve":"CVE-2022-48648","score":0.00226,"percentile":0.13322,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}