{
  "cveId": "CVE-2022-48818",
  "url": "https://patchblox.com/security/cve/CVE-2022-48818",
  "summary": "CVE-2022-48818 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48818, released July 16, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: dsa: mv88e6xxx: don\u0027t use devres for mdiobu...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: dsa: mv88e6xxx: don\u0027t use devres for mdiobus  As explained in commits: 74b6d7d13307 (\u0022net: dsa: realtek: register the MDIO bus under devres\u0022) 5135e96a3dd2 (\u0022net: dsa: don\u0027t allocate the slave_mii_bus using devres\u0022)  mdiobus_free() will panic when called from devm_mdiobus_free() \u003C- devres_release_all() \u003C- __device_release_driver(), and that mdiobus was not previously unregistered.  The mv88e6xxx is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call -\u003Eremove on -\u003Eshutdown) do not apply. But there is one more which applies here.  If the DSA master itself is on a bus that calls -\u003Eremove from -\u003Eshutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the Marvell switch driver on shutdown.  systemd-shutdown[1]: Powering off. mv88e6085 0x0000000008b96000:00 sw_gl0: Link is Down fsl-mc dpbp.9: Removing from iommu group 7 fsl-mc dpbp.8: Removing from iommu group 7 ------------[ cut here ]------------ kernel BUG at drivers/net/phy/mdio_bus.c:677! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00040-gdc05f73788e5 #15 pc : mdiobus_free\u002B0x44/0x50 lr : devm_mdiobus_free\u002B0x10/0x20 Call trace:  mdiobus_free\u002B0x44/0x50  devm_mdiobus_free\u002B0x10/0x20  devres_release_all\u002B0xa0/0x100  __device_release_driver\u002B0x190/0x220  device_release_driver_internal\u002B0xac/0xb0  device_links_unbind_consumers\u002B0xd4/0x100  __device_release_driver\u002B0x4c/0x220  device_release_driver_internal\u002B0xac/0xb0  device_links_unbind_consumers\u002B0xd4/0x100  __device_release_driver\u002B0x94/0x220  device_release_driver\u002B0x28/0x40  bus_remove_device\u002B0x118/0x124  device_del\u002B0x174/0x420  fsl_mc_device_remove\u002B0x24/0x40  __fsl_mc_device_remove\u002B0xc/0x20  device_for_each_child\u002B0x58/0xa0  dprc_remove\u002B0x90/0xb0  fsl_mc_driver_remove\u002B0x20/0x5c  __device_release_driver\u002B0x21c/0x220  device_release_driver\u002B0x28/0x40  bus_remove_device\u002B0x118/0x124  device_del\u002B0x174/0x420  fsl_mc_bus_remove\u002B0x80/0x100  fsl_mc_bus_shutdown\u002B0xc/0x1c  platform_shutdown\u002B0x20/0x30  device_shutdown\u002B0x154/0x330  kernel_power_off\u002B0x34/0x6c  __do_sys_reboot\u002B0x15c/0x250  __arm64_sys_reboot\u002B0x20/0x30  invoke_syscall.constprop.0\u002B0x4c/0xe0  do_el0_svc\u002B0x4c/0x150  el0_svc\u002B0x24/0xb0  el0t_64_sync_handler\u002B0xa8/0xb0  el0t_64_sync\u002B0x178/0x17c  So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don\u0027t use devres at all.  The Marvell driver already has a good structure for mdiobus removal, so just plug in mdiobus_free and get rid of devres.",
  "published": "2024-07-16T12:15:05Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00275,
  "epssPercentile": 0.20075,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.16.10-1",
      "fix": "DEBIAN-CVE-2022-48818",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48818",
      "released": "2024-07-16T12:15:05Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.16.10-1",
      "fix": "DEBIAN-CVE-2022-48818",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48818",
      "released": "2024-07-16T12:15:05Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.16.10-1",
      "fix": "DEBIAN-CVE-2022-48818",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48818",
      "released": "2024-07-16T12:15:05Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}