CVE-2022-49096 is a vulnerability in the Linux kernel's sfc network driver, which handles Solarflare network adapters. The issue arises when the transmit (tx) and receive (rx) ring buffer sizes are changed using the ethtool -G command. Normally, the sfc driver reallocates and reinitializes the rx and tx queues and their buffers accordingly. However, it fails to reinitialize the XDP (eXpress Data Path) queues, specifically the efx->xdp_tx_queues, which are used when the kernel operates in XDP_TX or XDP_REDIRECT modes. This omission leads to the use of uninitialized tx_queue->buffer memory during packet transmission or redirection, causing a kernel NULL pointer dereference and resulting in a kernel panic (system crash). The vulnerability manifests as a BUG in the kernel with a NULL pointer dereference at address 0x2a, as shown in the provided kernel oops logs. The fix involved separating the handling of XDP queues into a new function efx_set_xdp_channels(), ensuring proper reinitialization of these queues when ring buffer sizes change. This vulnerability affects Linux kernel versions containing the sfc driver with the specified commit hashes and was published on February 26, 2025. There are no known exploits in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the sfc driver managing Solarflare network adapters, especially those utilizing XDP features for high-performance packet processing. Exploitation leads to a kernel panic, causing denial of service (DoS) by crashing affected systems. This can disrupt critical network services, affecting availability and potentially leading to operational downtime. While the vulnerability does not directly allow privilege escalation or data leakage, the resulting instability can impact network infrastructure, servers, and cloud environments relying on affected hardware and kernel versions. Organizations using advanced networking features like XDP for packet filtering, load balancing, or DDoS mitigation may be particularly vulnerable. The lack of known exploits reduces immediate risk, but unpatched systems remain susceptible to accidental or malicious triggering of the bug, especially in environments where ring buffer sizes are dynamically adjusted.

European organizations should prioritize updating their Linux kernels to versions that include the patch fixing CVE-2022-49096. Specifically, ensure that the sfc driver version includes the efx_set_xdp_channels() function that properly reinitializes XDP queues after ring buffer size changes. Until patches are applied, avoid changing tx/rx ring buffer sizes on systems using the sfc driver with XDP enabled. Network administrators should audit their infrastructure to identify servers and devices using Solarflare network adapters and verify kernel versions. Implement monitoring to detect kernel panics or crashes related to the sfc driver. For environments requiring dynamic ring buffer adjustments, consider temporarily disabling XDP features or migrating workloads to unaffected hardware. Additionally, maintain robust backup and recovery procedures to minimize downtime in case of crashes. Engage with Linux distribution vendors for timely security updates and apply them promptly.