CVE-2022-48817: net: dsa: ar9331: register the mdiobus under devres
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: ar9331: register the mdiobus under devres
As explained in commits:
74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres")
5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres")
mdiobus_free() will panic when called from devm_mdiobus_free() <-
devres_release_all() <- __device_release_driver(), and that mdiobus was
not previously unregistered.
The ar9331 is an MDIO device, so the initial set of constraints that I
thought would cause this (I2C or SPI buses which call ->remove on
->shutdown) do not apply. But there is one more which applies here.
If the DSA master itself is on a bus that calls ->remove from ->shutdown
(like dpaa2-eth, which is on the fsl-mc bus), there is a device link
between the switch and the DSA master, and device_links_unbind_consumers()
will unbind the ar9331 switch driver on shutdown.
So the same treatment must be applied to all DSA switch drivers, which
is: either use devres for both the mdiobus allocation and registration,
or don't use devres at all.
The ar9331 driver doesn't have a complex code structure for mdiobus
removal, so just replace of_mdiobus_register with the devres variant in
order to be all-devres and ensure that we don't free a still-registered
bus.
Security readout for executives and security teams
Plain-English summary
CVE-2022-48817 is a Linux kernel bug in the AR9331 DSA switch driver. Under specific shutdown/unbind conditions, the kernel can panic because an MDIO bus is freed while still registered. This is primarily an availability risk for systems using this driver and hardware path, not a broadly documented remote compromise issue.
Executive priority
Treat as a targeted reliability fix. Prioritize affected embedded, router, or networking platforms where unexpected kernel panics could disrupt service. Broad emergency response is not supported by the available evidence.
Technical view
The AR9331 DSA driver used devres inconsistently for MDIO bus lifecycle handling. During device release, devm_mdiobus_free() can call mdiobus_free() before the bus is unregistered, causing a panic. The fix changes registration to the devres variant so allocation and registration are managed consistently.
Likely exposure
Exposure appears limited to Linux systems with the AR9331 DSA switch driver in use, especially where shutdown triggers driver unbind through device links to a DSA master. Generic Linux servers without this driver or hardware path are unlikely to be affected.
Exploitation context
The sources describe a kernel panic during shutdown or driver unbind conditions. They do not report active exploitation, public exploit code, or remote attack paths. CISA KEV status is false in the provided bundle.
Researcher notes
The CVE record lists severity as unknown and provides no CVSS or CWE. The root issue is lifecycle mismatch around mdiobus registration and devres cleanup. Affected-version data in the source bundle is sparse, so validate through kernel commit history or vendor backports.
Mitigation direction
Update to a kernel or vendor package containing the referenced stable fixes.
Check distribution advisories for backported fixes for CVE-2022-48817.
Prioritize embedded or networking devices using AR9331 DSA switch support.
If no update is available, seek vendor guidance for operational workarounds.
Validation and detection
Inventory Linux kernel versions on systems using AR9331 DSA hardware.
Confirm whether the AR9331 DSA switch driver is enabled and in use.
Compare deployed kernel source or package changelog against the referenced stable commits.
Review shutdown or driver-unbind logs for kernel panic symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-48817 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.