CVE-2022-48719 is a vulnerability identified in the Linux kernel's networking subsystem, specifically within the neighbor (neigh) management code. The flaw arises from a deadlock condition triggered when the kernel attempts to handle neighbor entries that have transitioned to the NUD_FAILED state. The vulnerability is rooted in the interaction between immediate probing triggered by __neigh_event_send() and the locking mechanism protecting the neighbor table. When a neighbor entry fails (NUD_FAILED), the kernel tries to send an immediate probe (neigh_probe) while holding a lock on the neighbor table. This immediate probe invocation while holding the lock leads to a deadlock because the probe function attempts to acquire the same lock already held by the current task. The deadlock was reproducible using the syzkaller kernel fuzzer, which demonstrated that the kworker thread attempting to acquire the lock was already holding it, causing the system to hang. The root cause is linked to a recent change (commit cd28ca0a3dd1) intended to reduce ARP latency by triggering immediate probes on failure states. The fix involves deferring the immediate probe back to the neigh_timer_handler, similar to the behavior before the commit, but only for NTF_MANAGED entries where this deferral is acceptable. This is achieved by adding a parameter to __neigh_event_send() to control whether immediate probing is allowed, preventing the deadlock scenario. This vulnerability affects Linux kernel versions identified by the commit hash 7482e3841d520a368426ac196720601687e2dc47 and was published on June 20, 2024. There are no known exploits in the wild currently, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions, which are common in servers, network appliances, and embedded devices. The deadlock can cause kernel worker threads to hang, potentially leading to system instability, degraded network performance, or denial of service (DoS) conditions. This can disrupt critical services, especially in environments relying heavily on Linux-based infrastructure such as cloud providers, telecommunications, financial institutions, and government agencies. The impact on confidentiality and integrity is minimal since the vulnerability does not directly allow code execution or privilege escalation. However, availability is significantly affected due to the potential for deadlocks causing system hangs or crashes. In networked environments, this could lead to outages or degraded service quality, impacting business continuity and operational reliability.

European organizations should prioritize updating their Linux kernel to versions that include the patch for CVE-2022-48719 as soon as it becomes available. Until patches are applied, organizations can mitigate risk by: 1) Monitoring kernel logs for signs of deadlocks or related errors in the neighbor subsystem. 2) Limiting exposure of vulnerable systems to untrusted networks to reduce the chance of triggering the deadlock. 3) Employing kernel hardening and monitoring tools that can detect and alert on kernel worker thread stalls or hangs. 4) For critical systems, consider implementing redundancy and failover mechanisms to maintain availability in case of a deadlock-induced outage. 5) Engage with Linux distribution vendors to obtain backported patches if immediate kernel upgrades are not feasible. 6) Review and restrict network configurations that may cause frequent neighbor state transitions to NUD_FAILED, reducing the likelihood of triggering the vulnerability.