CVE-2022-48814: net: dsa: seville: register the mdiobus under devres
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: seville: register the mdiobus under devres
As explained in commits:
74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres")
5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres")
mdiobus_free() will panic when called from devm_mdiobus_free() <-
devres_release_all() <- __device_release_driver(), and that mdiobus was
not previously unregistered.
The Seville VSC9959 switch is a platform device, so the initial set of
constraints that I thought would cause this (I2C or SPI buses which call
->remove on ->shutdown) do not apply. But there is one more which
applies here.
If the DSA master itself is on a bus that calls ->remove from ->shutdown
(like dpaa2-eth, which is on the fsl-mc bus), there is a device link
between the switch and the DSA master, and device_links_unbind_consumers()
will unbind the seville switch driver on shutdown.
So the same treatment must be applied to all DSA switch drivers, which
is: either use devres for both the mdiobus allocation and registration,
or don't use devres at all.
The seville driver has a code structure that could accommodate both the
mdiobus_unregister and mdiobus_free calls, but it has an external
dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls
devm_mdiobus_alloc_size() on its behalf. So rather than restructuring
that, and exporting yet one more symbol mscc_miim_teardown(), let's work
with devres and replace of_mdiobus_register with the devres variant.
When we use all-devres, we can ensure that devres doesn't free a
still-registered bus (it either runs both callbacks, or none).
Security readout for executives and security teams
Plain-English summary
CVE-2022-48814 is a Linux kernel reliability flaw in the DSA Seville switch driver. Under specific hardware and shutdown/unbind conditions, the kernel can panic. This is mainly a denial-of-service or availability concern for systems using the affected networking hardware, not a broadly exploitable remote attack based on the provided sources.
Executive priority
Treat as targeted availability risk. Prioritize patching where affected networking hardware supports production traffic or appliance uptime. Broad enterprise urgency is lower unless this driver and platform combination is present.
Technical view
The issue occurs when an MDIO bus allocated with devres is freed without first being unregistered. In the Seville VSC9959 DSA switch path, shutdown-related driver unbinds can trigger devres cleanup and panic. The fix changes registration to the devres-managed variant so unregister/free ordering is handled consistently.
Likely exposure
Exposure appears limited to Linux systems using the Seville VSC9959 DSA switch driver, especially where the DSA master bus can unbind consumers during shutdown, such as the example dpaa2-eth on fsl-mc cited in the kernel text.
Exploitation context
No active exploitation is indicated by KEV or the provided sources. The described trigger is a shutdown or driver-unbind cleanup path on specific hardware, leading to kernel panic rather than code execution.
Researcher notes
The source record has no CVSS, CWE, or KEV signal. Version data in the bundle is limited and should be validated against downstream vendor kernels. The root cause and fix are clearly described in Linux stable commit references.
Mitigation direction
Apply a kernel version or vendor update containing the referenced stable fixes.
Prioritize embedded, networking, or appliance systems using Seville VSC9959 DSA hardware.
Check Linux distribution or device vendor advisories for backported fixes.
If hardware is not present, document non-exposure for this CVE.
Validation and detection
Inventory systems for Linux kernels and Seville VSC9959 DSA switch usage.
Compare kernel source or package changelog against the referenced stable commits.
Review shutdown or reboot logs for kernel panics in mdiobus cleanup paths.
Confirm vendor kernels include the devm_of_mdiobus_register-related fix.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-48814 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.