CVE-2022-48854

What it actually does

Use-after-free in arc_mdio_probe() where mdiobus_free() releases the mdio bus structure while bus->name is still dereferenced afterward for an error message.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; widespread impact on embedded and networking devices using the arc_emac driver until patched.

How an attack unfolds

An attacker with local access crafts conditions that cause the mdio bus allocation check to fail after mdiobus_free(), then reuses the freed structure via the stale name pointer to corrupt kernel memory or execute arbitrary code.

How to fix it

Upgrade the Linux kernel to a version containing commit 84c831803785c2c3bec5c28c0e8a0b72f6b41d4d or later; rebuild and reboot with the fixed kernel; apply vendor backports if using a distribution kernel.

How to confirm the fix worked

Verify the running kernel includes commit 84c831803785c2c3bec5c28c0e8a0b72f6b41d4d via git log or kernel version string; test arc_mdio_probe error paths in a lab environment to confirm no UAF occurs; monitor for related kernel oops or warnings.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel with arc_emac enabled
2. Trigger arc_mdio_probe() under conditions that set bus->state to MDIOBUS_ALLOCATED
3. Force the error path that calls mdiobus_free(bus)
4. Access the dangling bus->name pointer to cause UAF
5. Leverage resulting memory corruption for escalation or denial of service

How to detect it

Inspect kernel logs for oops, warnings, or panic messages referencing arc_mdio_probe or mdiobus_free; search dmesg and syslog for use-after-free patterns or slab corruption near mdio bus allocation; correlate with processes exercising network interface bring-up on arc_emac hardware.

What your security team should do

• Prioritize kernel updates on all systems exposing arc_emac hardware within the next patching cycle
• Restrict local unprivileged access where possible until patched
• Include this fix in automated kernel update pipelines and golden images
• Review downstream dependent packages and rebuild any custom kernels