CVE catalog

CVE-2022-48818

linux: CVE-2022-48818

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Jul 16, 2024, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.27% · Oct 25, 2026

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The mv88e6xxx is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the Marvell switch driver on shutdown. systemd-shutdown[1]: Powering off. mv88e6085 0x0000000008b96000:00 sw_gl0: Link is Down fsl-mc dpbp.9: Removing from iommu group 7 fsl-mc dpbp.8: Removing from iommu group 7 ------------[ cut here ]------------ kernel BUG at drivers/net/phy/mdio_bus.c:677! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00040-gdc05f73788e5 #15 pc : mdiobus_free+0x44/0x50 lr : devm_mdiobus_free+0x10/0x20 Call trace: mdiobus_free+0x44/0x50 devm_mdiobus_free+0x10/0x20 devres_release_all+0xa0/0x100 __device_release_driver+0x190/0x220 device_release_driver_internal+0xac/0xb0 device_links_unbind_consumers+0xd4/0x100 __device_release_driver+0x4c/0x220 device_release_driver_internal+0xac/0xb0 device_links_unbind_consumers+0xd4/0x100 __device_release_driver+0x94/0x220 device_release_driver+0x28/0x40 bus_remove_device+0x118/0x124 device_del+0x174/0x420 fsl_mc_device_remove+0x24/0x40 __fsl_mc_device_remove+0xc/0x20 device_for_each_child+0x58/0xa0 dprc_remove+0x90/0xb0 fsl_mc_driver_remove+0x20/0x5c __device_release_driver+0x21c/0x220 device_release_driver+0x28/0x40 bus_remove_device+0x118/0x124 device_del+0x174/0x420 fsl_mc_bus_remove+0x80/0x100 fsl_mc_bus_shutdown+0xc/0x1c platform_shutdown+0x20/0x30 device_shutdown+0x154/0x330 kernel_power_off+0x34/0x6c __do_sys_reboot+0x15c/0x250 __arm64_sys_reboot+0x20/0x30 invoke_syscall.constprop.0+0x4c/0xe0 do_el0_svc+0x4c/0x150 el0_svc+0x24/0xb0 el0t_64_sync_handler+0xa8/0xb0 el0t_64_sync+0x178/0x17c So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The Marvell driver already has a good structure for mdiobus removal, so just plug in mdiobus_free and get rid of devres.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	linux	sid	`7.2.12-1`	fixed
Debian	linux	forky	`7.2.12-1`	fixed
Debian	linux	trixie	`6.12.107-1`	fixed
Debian	linux	trixie-security	`6.12.113-1`	fixed
Debian	linux	bookworm	`6.1.176-1`	fixed
Debian	linux	bookworm-security	`6.1.190-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	linux	source	sid	`5.16.10-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	forky	`5.16.10-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	trixie	`5.16.10-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	bookworm	`5.16.10-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[bpftool]Unknown
Source package: [linux]
Details (6)
- 7.1.0+6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 7.1.0+6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 7.1.0+6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 7.1.0+6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[hyperv-daemons]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[intel-sdsi]Unknown
Source package: [linux]
Details (1)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[libcpupower1]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[libcpupower-dev]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-bpf-dev]Unknown
Source package: [linux]
Details (2)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-compiler-gcc-12-x86]Unknown
Source package: [linux]
Details (2)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-config-6.1]Unknown
Source package: [linux]
Details (4)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-cpupower]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-doc]Unknown
Source package: [linux]
Details (32)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-doc-6.1]Unknown
Source package: [linux]
Details (6)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-common]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-common-rt]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-50-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.16.10-1
  dsa · linux · debian · bookworm

Next results

Observed: Oct 27, 2026, 2:58:36 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [SUSE security advisories and VEX]