CVE-2022-49350

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the mdio bus init() function being annotated with init while also being exported as a symbol. This combination is problematic because the .init.text section is freed after initialization, and modules cannot use symbols annotated with init, potentially leading to a kernel panic. The issue was previously undetected by modpost due to a decade-long bug but was recently identified after modpost was fixed.

Recommendations Remove EXPORT SYMBOL from the mdio bus init() function to prevent the vulnerability, as the only in-tree call site in drivers/net/phy/phy device.c is never compiled as modular.