PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22982 Linux CVE debrief

A Linux kernel vulnerability was resolved, affecting the ocelot driver. The vulnerability could cause a crash when adding an interface under a lag. This issue specifically affects the ocelot_vsc7514.c frontend, which leaves unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as it uses the DSA framework which registers all ports. Linux kernel users and administrators should review their systems for potential exposure, focusing on ocelot driver usage and system log reviews for crash reports.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

Linux kernel users and administrators who use the ocelot driver should review their systems for potential exposure. They should check if their systems use the ocelot driver and are affected by this vulnerability. Reviewing system logs for crash reports related to ocelot driver crashes is also recommended. Additionally, they should verify Linux kernel configurations for ocelot driver usage and perform vulnerability management reviews for affected systems.

Technical summary

The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic to the lan966x driver and is susceptible to a crash caused by a NULL pointer dereference. This issue specifically affects the ocelot_vsc7514.c frontend, which leaves unused ports as NULL pointers. The fix involves checking if the port pointer is valid before accessing it. Additionally, the ocelot driver requires careful review of system logs for crash reports related to ocelot driver crashes when adding interfaces under a lag. Linux kernel users and administrators should review their systems for potential exposure, focusing on ocelot driver usage.

Defensive priority

Medium

Recommended defensive actions

  • Review Linux kernel versions for potential exposure
  • Apply patches from Linux kernel maintainers
  • Monitor system logs for crash reports
  • Verify Linux kernel configurations for ocelot driver usage
  • Check for ocelot_vsc7514.c frontend usage in the environment
  • Perform vulnerability management reviews for affected systems
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-01-23T16:15:54.223Z and has not been modified since then. The NVD entry is currently Modified. Evidence is limited to CVE and NVD details. Defenders should verify Linux kernel versions for potential exposure, review system logs for crash reports related to ocelot driver crashes, and check for ocelot_vsc7514.c frontend usage in the environment. Further verification tasks are needed due to limited source detail.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22982 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22982

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22982 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22982

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/03fb1708b7d1e76aecebf767ad059c319845039f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2985712dc76dfa670eb7fd607c09d4d48e5f5c6e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8767f238b0e6c3d0b295ac6dce9fbe6a99bd1b9d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b17818307446c5a8d925a39a792261dbfa930041

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f490af47bbee02441e356a1e0b86e3b3dd5120ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-019113.html

    0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.