CVE-2022-49025: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49025 is a use-after-free vulnerability discovered in the Linux kernel's Mellanox Technologies driver for ConnectX-4 and Connect-IB cards. The vulnerability specifically affects the net/mlx5e component when handling termination tables (Red Hat CVE, CVE Mitre).

The vulnerability occurs when having multiple destinations with termination tables, where the second or subsequent destinations fail. In this scenario, the driver reverts the usage of term tables but fails to reset the assignment in attr->dests[numvportdests].termtbl, resulting in a use-after-free condition when releasing the rule. The issue was introduced in the commit that implemented VLAN push actions using termination tables (Kernel Commit).

This vulnerability allows a local user to crash the system, potentially leading to denial of service. The severity is rated as Moderate with a CVSS v3.1 base score of 6.4 according to Red Hat's assessment (Red Hat CVE).

As a mitigation, system administrators can prevent the mlx5_core module from being loaded by blacklisting it. For a permanent fix, the kernel patch resets the termtbl assignment to null when reverting termination table usage (Red Hat CVE).