CVE-2022-49472: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49472 is a vulnerability in the Linux kernel's network PHY (Physical Layer) driver for Micrel/Kendin KSZ series ethernet switches. The vulnerability was discovered when it was found that if the .probe element is present in the phy_driver structure and the .driver_data is not, a NULL pointer dereference occurs (Kernel Git).

The vulnerability exists in the drivers/net/phy/micrel.c file where several functions assume the presence of .driver_data without proper NULL checks. The issue specifically affects the handling of priv->type pointer, which could lead to NULL pointer dereference when accessing members like led_mode_reg, has_broadcast_disable, and has_rmii_ref_clk_sel (Kernel Git).

A NULL pointer dereference in the kernel driver could potentially lead to system crashes or denial of service conditions when attempting to probe certain Micrel/Kendin KSZ series ethernet devices (Kernel Git).

The issue has been fixed by adding NULL checks for priv->type before accessing its members. The patch was reviewed by Andrew Lunn and committed by Jakub Kicinski. The fix has been backported to multiple stable kernel versions (Kernel Git).