CVE-2022-48966

CVE-2022-48966 is an out-of-bounds read vulnerability in the Linux kernel's mvneta network driver, specifically affecting the mvneta_config_rss() function. This flaw occurs because user-supplied input for pp->indir[0] is not properly bounds-checked before being used in a CPU bitmap, potentially leading to an out-of-bounds read. With a CVSS score of 7.1 (High), this vulnerability can be exploited locally with low attack complexity and requires low privileges, potentially resulting in high confidentiality impact and high availability impact. The Common Weakness Enumeration (CWE) associated with this vulnerability is CWE-125, indicating an out-of-bounds read. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public attention.