--- cve: "CVE-2022-48817" severity: "LOW" cvss: 3.1 epss: "27%" vendor: "Linux" kev: false exploited: false published: "2024-07-16 12:15:05" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-13T00:24:54+02:00" --- # CVE-2022-48817 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: net: dsa: ar9331: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the ar9331 switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The ar9331 driver doesn't have a complex code structure for mdiobus removal, so just replace of_mdiobus_register with the devres variant in order to be all-devres and ensure that we don't free a still-registered bus. ## Patch verfügbar (OSV) - Kernel ≥ 5.10.101 - Kernel ≥ 5.15.24 - Kernel ≥ 5.16.10 ## Referenzen - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2022-48817) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_