Medium · 5.5 CVE-2022-3541 EUVD-2022-42907GHSA-mhhv-2rpc-5pwq

Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free

Published Oct 17, 2022 · Updated Apr 15, 2025 · Assigned by VulDB

Vendor: Linux Product: kernel Package: kernel Package: linux Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-edge Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gke-4.15 Package: linux-gke-5.4 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-lowlatency-hwe-6.2 Package: linux-nvidia-6.2 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-raspi2 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.8 Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/sunplus/spl2sw_driver.c of the component BPF. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211041 was assigned to this vulnerability.

Affected products

Vendor	Product	Affected	Fixed
Linux	Kernel	—	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	6.0.3-1	—
Debian 13	linux	6.0.3-1	—
Debian 12	linux	6.0.3-1	—

Ubuntu