LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48814: net: dsa: seville: register the mdiobus under devres

In the Linux kernel, the following vulnerability has been resolved: net: dsa: seville: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Seville VSC9959 switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the seville switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The seville driver has a code structure that could accommodate both the mdiobus_unregister and mdiobus_free calls, but it has an external dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls devm_mdiobus_alloc_size() on its behalf. So rather than restructuring that, and exporting yet one more symbol mscc_miim_teardown(), let's work with devres and replace of_mdiobus_register with the devres variant. When we use all-devres, we can ensure that devres doesn't free a still-registered bus (it either runs both callbacks, or none).

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-48814 is a Linux kernel reliability flaw in the DSA Seville switch driver. Under specific hardware and shutdown/unbind conditions, the kernel can panic. This is mainly a denial-of-service or availability concern for systems using the affected networking hardware, not a broadly exploitable remote attack based on the provided sources.

Executive priority

Treat as targeted availability risk. Prioritize patching where affected networking hardware supports production traffic or appliance uptime. Broad enterprise urgency is lower unless this driver and platform combination is present.

Technical view

The issue occurs when an MDIO bus allocated with devres is freed without first being unregistered. In the Seville VSC9959 DSA switch path, shutdown-related driver unbinds can trigger devres cleanup and panic. The fix changes registration to the devres-managed variant so unregister/free ordering is handled consistently.

Likely exposure

Exposure appears limited to Linux systems using the Seville VSC9959 DSA switch driver, especially where the DSA master bus can unbind consumers during shutdown, such as the example dpaa2-eth on fsl-mc cited in the kernel text.

Exploitation context

No active exploitation is indicated by KEV or the provided sources. The described trigger is a shutdown or driver-unbind cleanup path on specific hardware, leading to kernel panic rather than code execution.

Researcher notes

The source record has no CVSS, CWE, or KEV signal. Version data in the bundle is limited and should be validated against downstream vendor kernels. The root cause and fix are clearly described in Linux stable commit references.

Mitigation direction

  • Apply a kernel version or vendor update containing the referenced stable fixes.
  • Prioritize embedded, networking, or appliance systems using Seville VSC9959 DSA hardware.
  • Check Linux distribution or device vendor advisories for backported fixes.
  • If hardware is not present, document non-exposure for this CVE.

Validation and detection

  • Inventory systems for Linux kernels and Seville VSC9959 DSA switch usage.
  • Compare kernel source or package changelog against the referenced stable commits.
  • Review shutdown or reboot logs for kernel panics in mdiobus cleanup paths.
  • Confirm vendor kernels include the devm_of_mdiobus_register-related fix.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxac3a68d56651c3dad2c12c7afce065fe15267f44, ac3a68d56651c3dad2c12c7afce065fe15267f44, ac3a68d56651c3dad2c12c7afce065fe15267f44unaffected
LinuxLinux5.9, 0, 5.15.27, 5.16.10, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.