CVE-2022-49025

A use-after-free flaw was found in the Linux kernel ConnectX-4 and Connect-IB cards by the Mellanox Technologies driver. This flaw allows a local user to crash the system.

This vulnerability is rated as Moderate because exploitation requires local administrative privileges (such as CAP_NET_ADMIN) and specialized Mellanox network hardware. On typical Red Hat Enterprise Linux deployments, the affected execution path is only invoked during advanced flow offloading configurations involving multiple destination tables on Mellanox ConnectX devices. Because unprivileged local accounts and remote actors cannot configure hardware steering rules, the attack surface is constrained, limiting the risk primarily to localized denial of service or system instability initiated by privileged operators.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module mlx5_core from being loaded. Please see https://access.redhat.com/solutions/41278 on how to blacklist a kernel module to prevent it from loading automatically.