CVE-2022-48762 is a vulnerability identified in the Linux kernel specifically affecting the ARM64 architecture's exception handling code related to load_unaligned_zeropad operations. The flaw arises from incorrect extraction of register indices within the ex_handler_load_unaligned_zeropad() function. Instead of extracting the data and address register indices from the correct field (ex->data), the code erroneously extracts them from ex->type. Since ex->type contains a fixed value (EX_TYPE_LOAD_UNALIGNED_ZEROPAD = 4), this leads to the function always treating register X0 as the address register and X4 as the data register regardless of their actual intended values. Consequently, this can cause the kernel to dereference an arbitrary address stored in X0, potentially leading to a NULL pointer dereference or other arbitrary memory accesses. Additionally, register X4 may be corrupted, causing unpredictable behavior in the kernel and its callers. This issue is particularly observable on MTE-enabled QEMU images, where it triggers kernel crashes due to invalid memory accesses. The vulnerability has been fixed by correcting the code to extract register indices from ex->data as originally intended. The CVSS v3.1 base score is 6.2 (medium severity), with an attack vector of local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no impact on confidentiality or integrity (C:N/I:N), but high impact on availability (A:H) due to potential kernel crashes. No known exploits are currently reported in the wild. The affected Linux kernel versions include the commit 753b32368705c396000f95f33c3b7018474e33ad. This vulnerability is relevant primarily to ARM64 Linux kernel deployments, especially those using MTE (Memory Tagging Extension) features or running on ARM64 QEMU emulation environments.

For European organizations, the impact of CVE-2022-48762 depends largely on their use of ARM64-based Linux systems. Enterprises and service providers deploying ARM64 servers, embedded devices, or development environments with MTE-enabled kernels could experience system instability or denial of service due to kernel crashes triggered by this vulnerability. The availability impact is significant as kernel crashes can lead to service interruptions, affecting critical infrastructure, cloud services, or embedded systems. Although the vulnerability does not directly compromise confidentiality or integrity, the resulting denial of service could disrupt business operations, especially in sectors relying on ARM64 hardware such as telecommunications, automotive, IoT, and edge computing. Organizations using ARM64 QEMU for development or testing might also face instability. Since exploitation requires local access and no user interaction, the threat is more relevant to insider threats or attackers who have already gained some level of system access. The lack of known exploits in the wild reduces immediate risk, but the medium severity score and potential for availability disruption warrant timely patching to maintain operational continuity.

European organizations should prioritize updating their Linux kernels to versions that include the fix for CVE-2022-48762. Specifically, they should apply the patch correcting the register index extraction in ex_handler_load_unaligned_zeropad(). For environments using ARM64 hardware with MTE enabled, thorough testing of kernel updates is recommended to ensure stability. Organizations should also audit their use of ARM64 Linux systems, identifying any exposed or critical systems running vulnerable kernel versions. Limiting local access to trusted users and enforcing strict access controls can reduce the risk of exploitation. Additionally, monitoring kernel logs for signs of NULL pointer dereferences or unexpected crashes can help detect attempts to trigger this vulnerability. For development environments using QEMU with ARM64 emulation, updating QEMU and kernel images to patched versions is advised. Finally, integrating this vulnerability into vulnerability management and patching workflows ensures timely remediation and reduces exposure.