CVE-2022-48815: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48815 is a vulnerability in the Linux kernel's DSA (Distributed Switch Architecture) subsystem, specifically affecting the Broadcom Starfighter 2 switch driver (bcm_sf2). The issue was discovered in early 2022 and relates to improper handling of MDIO bus allocation and deallocation using the device resource management (devres) framework (Kernel Git).

The vulnerability occurs when mdiobus_free() is called from devm_mdiobus_free() through devres_release_all() and __device_release_driver() sequence, causing a kernel panic if the MDIO bus was not previously unregistered. This specifically affects scenarios where the DSA master is on a bus that calls ->remove from ->shutdown (like dpaa2-eth on the fsl-mc bus), creating a device link between the switch and the DSA master (Kernel Git).

When triggered, this vulnerability can cause a kernel panic in systems using the Broadcom Starfighter 2 switch driver, potentially leading to system crashes and denial of service conditions (Kernel Git).

The vulnerability is triggered during specific device shutdown sequences and requires particular hardware configurations involving the Broadcom Starfighter 2 switch and certain bus configurations (Kernel Git).

The issue has been resolved by replacing devm_mdiobus_alloc() with the non-devres variant and adding manual free operations where necessary. This ensures that the MDIO bus is properly deallocated without relying on the devres framework (Kernel Git).