LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48817: net: dsa: ar9331: register the mdiobus under devres

In the Linux kernel, the following vulnerability has been resolved: net: dsa: ar9331: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The ar9331 is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the ar9331 switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The ar9331 driver doesn't have a complex code structure for mdiobus removal, so just replace of_mdiobus_register with the devres variant in order to be all-devres and ensure that we don't free a still-registered bus.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-48817 is a Linux kernel bug in the AR9331 DSA switch driver. Under specific shutdown/unbind conditions, the kernel can panic because an MDIO bus is freed while still registered. This is primarily an availability risk for systems using this driver and hardware path, not a broadly documented remote compromise issue.

Executive priority

Treat as a targeted reliability fix. Prioritize affected embedded, router, or networking platforms where unexpected kernel panics could disrupt service. Broad emergency response is not supported by the available evidence.

Technical view

The AR9331 DSA driver used devres inconsistently for MDIO bus lifecycle handling. During device release, devm_mdiobus_free() can call mdiobus_free() before the bus is unregistered, causing a panic. The fix changes registration to the devres variant so allocation and registration are managed consistently.

Likely exposure

Exposure appears limited to Linux systems with the AR9331 DSA switch driver in use, especially where shutdown triggers driver unbind through device links to a DSA master. Generic Linux servers without this driver or hardware path are unlikely to be affected.

Exploitation context

The sources describe a kernel panic during shutdown or driver unbind conditions. They do not report active exploitation, public exploit code, or remote attack paths. CISA KEV status is false in the provided bundle.

Researcher notes

The CVE record lists severity as unknown and provides no CVSS or CWE. The root issue is lifecycle mismatch around mdiobus registration and devres cleanup. Affected-version data in the source bundle is sparse, so validate through kernel commit history or vendor backports.

Mitigation direction

  • Update to a kernel or vendor package containing the referenced stable fixes.
  • Check distribution advisories for backported fixes for CVE-2022-48817.
  • Prioritize embedded or networking devices using AR9331 DSA switch support.
  • If no update is available, seek vendor guidance for operational workarounds.

Validation and detection

  • Inventory Linux kernel versions on systems using AR9331 DSA hardware.
  • Confirm whether the AR9331 DSA switch driver is enabled and in use.
  • Compare deployed kernel source or package changelog against the referenced stable commits.
  • Review shutdown or driver-unbind logs for kernel panic symptoms.
Prepared
Confidence
medium
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48817 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxac3a68d56651c3dad2c12c7afce065fe15267f44, ac3a68d56651c3dad2c12c7afce065fe15267f44, ac3a68d56651c3dad2c12c7afce065fe15267f44, ac3a68d56651c3dad2c12c7afce065fe15267f44unaffected
LinuxLinux5.9, 0, 5.10.101, 5.15.24, 5.16.10, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.