Acknowledged
Created: Jul 16, 2024
Updated: Jan 7, 2026
Resolved Date: Jul 16, 2024
Found In Version: 10.24.33.1
Severity: Standard
Applicable for: Wind River Linux LTS 24
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:
net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if
this is the same as the port's pvid_vlan which we access afterwards,
what we're accessing is freed memory.
Fix the bug by determining whether to clear ocelot_port->pvid_vlan prior
to calling ocelot_vlan_member_del().
CREATE(Triage):(User=admin) CVE-2022-48779 (https://nvd.nist.gov/vuln/detail/CVE-2022-48779)
