boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-48932MEDIUM
Linux Linux — net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0019    9.2     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    1ffd498901c1134a7cbecf5409e12c064c39cef9 –  —
  Linux    5.16 –                                      5.16.12
TIMELINE
  Aug 21  Reserved by Linux
  Aug 22  Published (CNA: Linux)
  Aug 4   RESCORED — CVE-2022-48932 (Linux). CVSS 7.8 → 5.5 (NVD).
CWE-125 · CNA: Linux · CVSS v3.1 · 2 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte When adding a rule with 32 destinations, we hit the following out-of-band access issue: BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70 This patch fixes the issue by both increasing the allocated buffers to accommodate for the needed actions and by checking the number of actions to prevent this issue when a rule with too many actions is provided.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
August 21, 2024ReservedReserved by Linux
August 22, 2024PublishedPublished (CNA: Linux)
August 4, 2026RESCOREDRESCORED — CVE-2022-48932 (Linux). CVSS 7.8 → 5.5 (NVD).

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux1ffd498901c1134a7cbecf5409e12c064c39cef9
LinuxLinux5.165.16.12

Weaknesses

CWE-125

References (2)

Related

Authoritative record: CVE-2022-48932 at cve.org

Vendors: linux

Weaknesses: CWE-125

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-48932 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.