{"id":"DEBIAN-CVE-2022-48808","details":"In the Linux kernel, the following vulnerability has been resolved:  net: dsa: fix panic when DSA master device unbinds on shutdown  Rafael reports that on a system with LX2160A and Marvell DSA switches, if a reboot occurs while the DSA master (dpaa2-eth) is up, the following panic can be seen:  systemd-shutdown[1]: Rebooting. Unable to handle kernel paging request at virtual address 00a0000800000041 [00a0000800000041] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] PREEMPT SMP CPU: 6 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00042-g8f5585009b24 #32 pc : dsa_slave_netdevice_event+0x130/0x3e4 lr : raw_notifier_call_chain+0x50/0x6c Call trace:  dsa_slave_netdevice_event+0x130/0x3e4  raw_notifier_call_chain+0x50/0x6c  call_netdevice_notifiers_info+0x54/0xa0  __dev_close_many+0x50/0x130  dev_close_many+0x84/0x120  unregister_netdevice_many+0x130/0x710  unregister_netdevice_queue+0x8c/0xd0  unregister_netdev+0x20/0x30  dpaa2_eth_remove+0x68/0x190  fsl_mc_driver_remove+0x20/0x5c  __device_release_driver+0x21c/0x220  device_release_driver_internal+0xac/0xb0  device_links_unbind_consumers+0xd4/0x100  __device_release_driver+0x94/0x220  device_release_driver+0x28/0x40  bus_remove_device+0x118/0x124  device_del+0x174/0x420  fsl_mc_device_remove+0x24/0x40  __fsl_mc_device_remove+0xc/0x20  device_for_each_child+0x58/0xa0  dprc_remove+0x90/0xb0  fsl_mc_driver_remove+0x20/0x5c  __device_release_driver+0x21c/0x220  device_release_driver+0x28/0x40  bus_remove_device+0x118/0x124  device_del+0x174/0x420  fsl_mc_bus_remove+0x80/0x100  fsl_mc_bus_shutdown+0xc/0x1c  platform_shutdown+0x20/0x30  device_shutdown+0x154/0x330  __do_sys_reboot+0x1cc/0x250  __arm64_sys_reboot+0x20/0x30  invoke_syscall.constprop.0+0x4c/0xe0  do_el0_svc+0x4c/0x150  el0_svc+0x24/0xb0  el0t_64_sync_handler+0xa8/0xb0  el0t_64_sync+0x178/0x17c  It can be seen from the stack trace that the problem is that the deregistration of the master causes a dev_close(), which gets notified as NETDEV_GOING_DOWN to dsa_slave_netdevice_event(). But dsa_switch_shutdown() has already run, and this has unregistered the DSA slave interfaces, and yet, the NETDEV_GOING_DOWN handler attempts to call dev_close_many() on those slave interfaces, leading to the problem.  The previous attempt to avoid the NETDEV_GOING_DOWN on the master after dsa_switch_shutdown() was called seems improper. Unregistering the slave interfaces is unnecessary and unhelpful. Instead, after the slaves have stopped being uppers of the DSA master, we can now reset to NULL the master-\u003edsa_ptr pointer, which will make DSA start ignoring all future notifier events on the master.","modified":"2026-08-27T23:04:17.521445567Z","published":"2024-07-16T12:15:05.120Z","upstream":["CVE-2022-48808"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-48808"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48808.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48808.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48808.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}