CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag
In the Linux kernel, the following vulnerability has been resolved:
net: mscc: ocelot: Fix crash when adding interface under a lag
Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag") fixed a similar issue in the lan966x driver caused by a NULL pointer dereference. The ocelotsetaggrpgids() function in the ocelot driver has similar logic and is susceptible to the same crash.
This issue specifically affects the ocelotvsc7514.c frontend, which leaves unused ports as NULL pointers. The felixvsc9959.c frontend is unaffected as it uses the DSA framework which registers all ports.
Fix this by checking if the port pointer is valid before accessing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the crash by adding a NULL/invalid pointer check before dereferencing the port pointer when adding an interface under a LAG (use the same style of logic as ocelot_set_aggr_pgids()).
Linux kernel (net: mscc: ocelot) felix_vsc9959.c frontend port-pointer validation = Check that the port pointer is valid before accessing it
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22982?
CVE-2026-22982 is classified as a medium severity vulnerability.
How do I fix CVE-2026-22982?
To fix CVE-2026-22982, update the Linux kernel to the latest stable version that includes the fix.
What systems are affected by CVE-2026-22982?
CVE-2026-22982 affects the Linux kernel, specifically in configurations utilizing the mscc ocelot switch driver.
What are the potential consequences of CVE-2026-22982?
The potential consequences of CVE-2026-22982 include system crashes when adding interfaces under link aggregation.
Is there a workaround for CVE-2026-22982?
There are no known workarounds for CVE-2026-22982; updating the kernel is recommended for resolution.