cbcvebase.
CVE-2022-49350
published 2025-02-26

CVE-2022-49350: In the Linux kernel, the following vulnerability has been resolved: net: mdio: unexport __init-annotated mdio_bus_init() EXPORT_SYMBOL and __init is a bad…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.28%
20.7th percentile
In the Linux kernel, the following vulnerability has been resolved: net: mdio: unexport __init-annotated mdio_bus_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, drivers/net/phy/phy_device.c is never compiled as modular. (CONFIG_PHYLIB is boolean)

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.18.5-1 (bookworm)linux 5.18.5-1 (bookworm)
linuxlinux——
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < ab64ec2c75683f30ccde9eaaf0761002f901aa12ab64ec2c75683f30ccde9eaaf0761002f901aa12
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < 5534bcd7c40299862237c4a8fd9c5031b3db15385534bcd7c40299862237c4a8fd9c5031b3db1538
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < 6a90a44d53428a3bf01bd80df9ba78b19959270c6a90a44d53428a3bf01bd80df9ba78b19959270c
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < 7759c3222815b945a94b212bc0c6cdec475cfec27759c3222815b945a94b212bc0c6cdec475cfec2
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < 59fa94cddf9eef8d8dae587373eed8b8f4eb11d759fa94cddf9eef8d8dae587373eed8b8f4eb11d7
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < f5c68137f1191ba3fcf6260ec71b30be2e2bf4c3f5c68137f1191ba3fcf6260ec71b30be2e2bf4c3
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < f2f0f8c18b60ca64ff50892ed899cf1c77864755f2f0f8c18b60ca64ff50892ed899cf1c77864755
linuxlinux>= 90eff9096c01ba90cdae504a6b95ee87fe2556a3 < 35b42dce619701f1300fb8498dae82c9bb1f026335b42dce619701f1300fb8498dae82c9bb1f0263
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.127-15.10.127-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 4.12 < 4.14.2834.14.283
linuxlinux_kernel>= 4.15 < 4.19.2474.19.247
linuxlinux_kernel>= 4.20 < 5.4.1985.4.198
linuxlinux_kernel>= 5.11 < 5.15.475.15.47
linuxlinux_kernel>= 5.16 < 5.17.155.17.15
linuxlinux_kernel>= 5.18 < 5.18.45.18.4
linuxlinux_kernel>= 5.5 < 5.10.1225.10.122

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.