The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: dsa: mv88e6xxx: don't use devres for mdiobus As explained in commits: 74b6d7d13307 (net: dsa:
    realtek: register the MDIO bus under devres) 5135e96a3dd2 (net: dsa: don't allocate the slave_mii_bus     using devres) mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <-
    __device_release_driver(), and that mdiobus was not previously unregistered. The mv88e6xxx is an MDIO     device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call
    ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself     is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a     device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the     Marvell switch driver on shutdown. systemd-shutdown[1]: Powering off. mv88e6085 0x0000000008b96000:00     sw_gl0: Link is Down fsl-mc dpbp.9: Removing from iommu group 7 fsl-mc dpbp.8: Removing from iommu group 7
    ------------[ cut here ]------------ kernel BUG at drivers/net/phy/mdio_bus.c:677! Internal error: Oops -     BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted     5.16.5-00040-gdc05f73788e5 #15 pc : mdiobus_free+0x44/0x50 lr : devm_mdiobus_free+0x10/0x20 Call trace:
    mdiobus_free+0x44/0x50 devm_mdiobus_free+0x10/0x20 devres_release_all+0xa0/0x100
    __device_release_driver+0x190/0x220 device_release_driver_internal+0xac/0xb0     device_links_unbind_consumers+0xd4/0x100 __device_release_driver+0x4c/0x220     device_release_driver_internal+0xac/0xb0 device_links_unbind_consumers+0xd4/0x100
    __device_release_driver+0x94/0x220 device_release_driver+0x28/0x40 bus_remove_device+0x118/0x124     device_del+0x174/0x420 fsl_mc_device_remove+0x24/0x40 __fsl_mc_device_remove+0xc/0x20     device_for_each_child+0x58/0xa0 dprc_remove+0x90/0xb0 fsl_mc_driver_remove+0x20/0x5c
    __device_release_driver+0x21c/0x220 device_release_driver+0x28/0x40 bus_remove_device+0x118/0x124     device_del+0x174/0x420 fsl_mc_bus_remove+0x80/0x100 fsl_mc_bus_shutdown+0xc/0x1c     platform_shutdown+0x20/0x30 device_shutdown+0x154/0x330 kernel_power_off+0x34/0x6c
    __do_sys_reboot+0x15c/0x250 __arm64_sys_reboot+0x20/0x30 invoke_syscall.constprop.0+0x4c/0xe0     do_el0_svc+0x4c/0x150 el0_svc+0x24/0xb0 el0t_64_sync_handler+0xa8/0xb0 el0t_64_sync+0x178/0x17c So the     same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus     allocation and registration, or don't use devres at all. The Marvell driver already has a good structure     for mdiobus removal, so just plug in mdiobus_free and get rid of devres. (CVE-2022-48818)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2022-48818

medium Nessus Plugin ID 225802

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.6

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.13 Jan 15, 2026, 2:04 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601151404
Version 1.12 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.11 Oct 28, 2025, 5:56 PM Detection (updated detection logic) Plugin Feed: 202510281756
Version 1.10 Oct 27, 2025, 11:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.6 Sep 6, 2025, 10:42 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509061042
Version 1.4 Sep 2, 2025, 6:30 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509020630
Version 1.3 Aug 23, 2025, 2:29 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508230229
Version 1.2 Aug 9, 2025, 7:26 AM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508090726
Version 1.1 Mar 5, 2025, 4:35 PM New Plugin Feed: 202503051635