{"cve":"CVE-2022-48949","nvd":{"published":"2024-10-21T20:15:06.337","modified":"2026-06-17T05:16:41.573","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Initialize mailbox message for VF reset\n\nWhen a MAC address is not assigned to the VF, that portion of the message\nsent to the VF is not set. The memory, however, is allocated from the\nstack meaning that information may be leaked to the VM. Initialize the\nmessage buffer to 0 so that no information is passed to the VM in this\ncase.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cwes":["CWE-908"],"references":["https://git.kernel.org/stable/c/367e1e3399dbc56fc669740c4ab60e35da632b0e","https://git.kernel.org/stable/c/51fd5ede7ed42f272682a0c33d6f0767b3484a3d","https://git.kernel.org/stable/c/a6629659af3f5c6a91e3914ea62554c975ab77f4","https://git.kernel.org/stable/c/c383c7c35c7bc15e07a04eefa060a8a80cbeae29","https://git.kernel.org/stable/c/c581439a977545d61849a72e8ed631cfc8a2a3c1"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:56:33.105311382+00:00"},"epss":{"cve":"CVE-2022-48949","score":0.00252,"percentile":0.16789,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}