CVE-2022-49350: 
Linux Kernel 5FOqC0

CVE-2022-49350 affects the Linux kernel's MDIO (Management Data Input/Output) bus initialization functionality. The vulnerability stems from an improper combination of EXPORTSYMBOL and _init annotations in the mdiobusinit() function. The issue was discovered when modpost warnings were fixed, revealing this long-standing problem in the Linux kernel (Kernel Git).

The vulnerability occurs because the mdiobusinit() function was marked with both EXPORTSYMBOL and _init annotations. This is problematic as the _init annotation causes the code to be placed in the .init.text section, which is freed after initialization, while EXPORTSYMBOL makes the function available to loadable modules. When modules attempt to access this freed memory, it can result in a kernel panic (Kernel Git).

If exploited, this vulnerability can lead to kernel panic conditions when modules attempt to access the freed memory space of the mdiobusinit() function. This could result in system instability and potential denial of service (Kernel Git).

The issue was resolved by removing the EXPORTSYMBOL annotation while keeping the _init annotation, as this was deemed the most appropriate solution given that the only in-tree usage is never compiled as a module. This fix prevents modules from attempting to access the freed memory space (Kernel Git).