CVE-2022-48666 is a high-severity use-after-free vulnerability in the Linux kernel's SCSI subsystem, specifically within the handling of the .exit_cmd_priv function related to the SCSI host resources. The vulnerability arises because there are two implementations of the .exit_cmd_priv function that both utilize resources tied to the SCSI host. However, these resources may be freed prematurely, leading to a use-after-free condition. The fix involves ensuring that the resources remain available when .exit_cmd_priv is called by waiting inside the scsi_remove_host() function until the tag set has been fully freed. The vulnerability was detected by the Kernel Address Sanitizer (KASAN) as a use-after-free in the srp_exit_cmd_priv function within the ib_srp module, which is part of the SCSI RDMA Protocol (SRP) implementation. The call trace indicates that the issue occurs during the release and cleanup of SCSI devices and multipath device-mapper components, which are commonly used in enterprise storage environments. The vulnerability affects Linux kernel versions identified by the commit hash 65ca846a53149a1a72cd8d02e7b2e73dd545b834 and possibly others in the same range. The CVSS v3.1 base score is 7.4, reflecting high severity with a vector indicating local attack vector (AV:L), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits are currently reported in the wild. The vulnerability is classified under CWE-416 (Use After Free). This flaw could potentially allow a local attacker or malicious process with access to the affected system to cause memory corruption, leading to system crashes, denial of service, or potentially privilege escalation or arbitrary code execution within the kernel context.

For European organizations, this vulnerability poses a significant risk especially to enterprises and data centers relying on Linux-based servers with SCSI storage subsystems, including those using multipath device-mapper configurations for high availability and redundancy. The use-after-free can lead to kernel crashes (denial of service), data corruption, or potentially privilege escalation if exploited, impacting confidentiality, integrity, and availability of critical systems. This is particularly concerning for sectors with stringent data protection requirements such as finance, healthcare, telecommunications, and government agencies across Europe. The high impact on availability could disrupt business operations, while confidentiality and integrity breaches could lead to data leaks or manipulation. Since the attack vector is local and requires high complexity, exploitation is less trivial but still feasible in environments where untrusted local users or compromised processes exist. The lack of user interaction and no privilege requirement means that once local access is gained, exploitation can proceed without further conditions. Given the widespread use of Linux in European IT infrastructure, the vulnerability could affect a broad range of systems if patches are not applied promptly.

European organizations should prioritize patching Linux kernels to versions that include the fix for CVE-2022-48666. Specifically, update to kernel versions that incorporate the commit ensuring proper synchronization in scsi_remove_host() to prevent premature freeing of SCSI host resources. In environments where immediate patching is not feasible, organizations should restrict local access to trusted users only and monitor for unusual activity related to SCSI device management or multipath device-mapper operations. Employ kernel hardening techniques such as Kernel Address Sanitizer (KASAN) in testing environments to detect similar issues proactively. Additionally, review and tighten access controls on systems with SCSI multipath configurations, and audit multipathd and device-mapper usage to detect anomalies. Implement comprehensive logging and alerting for kernel errors or crashes related to SCSI subsystems. For critical systems, consider isolating or sandboxing processes that interact with SCSI devices to limit potential exploitation scope. Finally, maintain up-to-date backups and disaster recovery plans to mitigate impact from potential denial of service or data corruption incidents.