CVE-2026-22982 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2026-22982?

CVE-2026-22982 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's ocelot network driver causes a kernel crash when adding a network interface under a link aggregation group (LAG). This affects systems using the ocelot_vsc7514.c driver frontend, potentially causing denial of service.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's ocelot network driver causes a kernel crash when adding a network interface under a link aggregation group (LAG). This affects systems using the ocelot_vsc7514.c driver frontend, potentially causing denial of service.

💻 Affected Systems

Products:

Linux kernel with ocelot network driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using the ocelot_vsc7514.c driver frontend. Systems using felix_vsc9959.c (via DSA framework) are unaffected. Requires specific network configuration actions to trigger.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and complete denial of service, requiring physical or remote console access to reboot.

🟠

Likely Case

System crash when network administrators attempt to configure link aggregation, resulting in temporary service disruption until system reboot.

🟢

If Mitigated

No impact if the vulnerable driver is not loaded or if affected configurations are avoided.

🌐 Internet-Facing: LOW - Requires local network configuration access, not typically exploitable from internet.

🏢 Internal Only: MEDIUM - Network administrators or automated configuration tools could trigger the crash during routine operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local network configuration privileges to trigger. Not a remote code execution vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions containing the fix commits (03fb1708b7d1e76aecebf767ad059c319845039f and related)

Vendor Advisory: https://git.kernel.org/stable/c/03fb1708b7d1e76aecebf767ad059c319845039f

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Avoid LAG configuration on ocelot ports

linux

Do not configure link aggregation groups on interfaces using the ocelot_vsc7514.c driver

Unload ocelot driver if not needed

linux

Remove the vulnerable driver module if the hardware is not in use

rmmod mscc_ocelot_common
rmmod ocelot

🧯 If You Can't Patch

Restrict network configuration privileges to prevent accidental triggering
Monitor system logs for kernel panic events and have reboot procedures ready

🔍 How to Verify

Check if Vulnerable:

Check if ocelot driver is loaded: lsmod | grep ocelot. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

After kernel update, verify the fix commit is present in kernel source or that the driver version has been updated.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference errors in dmesg
System crash/reboot events

Network Indicators:

Sudden loss of network connectivity on affected ports

SIEM Query:

event_type:"kernel_panic" OR message:"NULL pointer dereference" AND driver:"ocelot"

📊 Metadata

CVE ID: CVE-2026-22982

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.03% exploit probability (8.9th percentile)

Published: January 23, 2026

Last Updated: February 26, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-22982, you might also want to check these: