CVE-2022-49021

What it actually does

Null pointer dereference in klist_put during __device_release_driver when PHY probe fails after dev->driver is set in phy_attach_direct but knode_driver is uninitialized, causing crash on device_del.

Why it matters to the business

Kernel panics and system reboots on Linux hosts with affected network PHY devices, interrupting network connectivity and workloads until patched.

How an attack unfolds

Attacker induces PHY probe failure (via fault injection, malicious hardware, or driver error paths) then triggers device removal, hitting the uninitialized knode path in device_release_driver_internal; referenced in broader 2024 espionage and financially motivated campaigns targeting Linux kernel flaws.

How to fix it

Upgrade Linux kernel to commit 8aaafe0f71314f46a066382a047ba8bb3840d273 or equivalent stable branches containing the phy_attach_direct error-path fix setting dev->driver to NULL.

How to confirm the fix worked

Verify presence of the fix by inspecting phy_attach_direct error handling in kernel source; test probe-failure scenarios with fault injection to confirm no dereference occurs.

Typical attack path

1. Cause PHY device probe failure in phy_attach_direct after setting dev->driver
2. Trigger device removal path via mdiobus_unregister or similar
3. Execute device_release_driver_internal leading to klist_remove on uninitialized knode
4. Trigger null dereference and kernel oops

How to detect it

Search kernel logs and crash dumps for null pointer dereference at address 0000000000000058 with call traces containing klist_put, klist_remove, device_release_driver_internal, phy_device_remove, and mdiobus_unregister.

• BUG: kernel NULL pointer dereference, address: 0000000000000058
• klist_put+0x2d/0xd0
• phy_device_remove+0x11/0x30
• device_release_driver_internal+0x23e/0x2d0

What your security team should do

• Apply the referenced kernel commit or latest stable release containing the fix with priority due to 726 days since publication
• Monitor kernel logs for related oops and null-deref traces involving phy and klist
• Restrict untrusted hardware or driver loading that could trigger probe failures