CVE-2022-48813

What it actually does

Use-after-free during MDIO bus teardown in the felix DSA switch driver when devres releases a still-registered bus on driver unbind triggered by device links during shutdown of the DSA master.

Why it matters to the business

Unexpected kernel panics and system crashes on affected Linux distributions using DSA-based network switches can cause unplanned downtime in servers, embedded devices, and network appliances.

How an attack unfolds

An attacker with the ability to trigger shutdown or driver unbind on a system whose DSA master resides on a bus that calls remove during shutdown causes device_links_unbind_consumers to detach the felix driver; devres then frees the mdiobus without prior unregistration, resulting in a panic inside mdiobus_free.

How to fix it

Upgrade the Linux kernel to a fixed version: Debian 11 to 5.10.84-1, Debian 12/13 to 5.14.16-1, Ubuntu 20.04 LTS packages to the listed 5.15.0 or 5.4.0 point releases, and Ubuntu 22.04 LTS to 5.15.0-17.17 or 6.5.0-1008.8~22.04.1 as applicable per package.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds one of the fixed package versions for the distribution in use and verify absence of the vulnerable devm_mdiobus_alloc_size call in the felix driver source.

Typical attack path

1. Obtain local or remote code execution sufficient to initiate system shutdown or module unload
2. Trigger device link unbind of the DSA master on a bus such as fsl-mc
3. Force the felix driver remove path while the mdiobus remains registered
4. Allow devres_release_all to invoke devm_mdiobus_free on the unregistered bus
5. Induce kernel panic or attempt to leverage the UAF for further exploitation

How to detect it

Search kernel logs and crash dumps for panic strings referencing mdiobus_free, devm_mdiobus_free, or felix driver unregistration failures around shutdown events.

What your security team should do

• Apply distribution kernel updates containing the fix at the earliest maintenance window
• Prioritize systems exposing network interfaces via felix or other DSA drivers
• Reboot after package installation to load the corrected kernel
• Review dmesg and kernel logs for mdiobus-related panics as an interim detection measure