CVE-2022-48785 is a vulnerability identified in the Linux kernel's IPv6 multicast handling code. The issue stems from an unsafe use of the function ipv6_get_lladdr() within the multicast IPv6 code paths. Originally, the Linux kernel used ipv6_get_lladdr(), which is RCU-safe (Read-Copy-Update safe), ensuring safe concurrent access to network device link-layer addresses. However, a commit (hash 8965779d2c0e) replaced this with __ipv6_get_lladdr(), an RCU-unsafe variant, under the assumption that the idev->lock was held to protect the code path. Later, another commit (88e2ca308094) removed these external locks, making the use of the RCU-unsafe __ipv6_get_lladdr() unsafe. This race condition can lead to dereferencing invalid pointers, causing kernel crashes or stalls, as evidenced by the general protection fault and non-canonical address errors in kernel logs. The crash occurs in the mld_ifc_work kernel thread, which handles multicast listener discovery (MLD) for IPv6. The vulnerability can cause system instability and denial of service due to kernel panics or stalls. Although no known exploits are reported in the wild, the vulnerability affects Linux kernel versions containing the specified commits and is relevant for any systems using IPv6 multicast functionality. The root cause is a concurrency bug related to improper locking and unsafe pointer dereferencing in kernel networking code.

For European organizations, this vulnerability poses a risk primarily to servers and network infrastructure running vulnerable Linux kernel versions with IPv6 multicast enabled. The impact includes potential denial of service due to kernel crashes or system stalls, which can disrupt critical services such as web hosting, cloud infrastructure, telecommunications, and industrial control systems. Organizations relying on Linux-based routers, firewalls, or IoT gateways that utilize IPv6 multicast may experience network outages or degraded performance. Given the increasing adoption of IPv6 in Europe and the prevalence of Linux in enterprise and cloud environments, the vulnerability could affect a broad range of sectors including finance, healthcare, government, and telecommunications. While no remote code execution or privilege escalation is indicated, the denial of service impact can still cause significant operational disruption and financial loss. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to prevent potential exploitation or accidental crashes.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched, restoring the use of the RCU-safe ipv6_get_lladdr() function in the multicast code path. Kernel updates should be applied promptly following vendor advisories. For environments where immediate patching is not feasible, organizations should consider disabling IPv6 multicast functionality if it is not required, as a temporary mitigation to reduce exposure. Network administrators should monitor system logs for signs of kernel panics or general protection faults related to IPv6 multicast. Additionally, implementing robust kernel crash recovery mechanisms and high availability configurations can minimize service disruption. Organizations should also audit their Linux kernel versions across infrastructure to identify vulnerable systems, including cloud instances, containers, and embedded devices. Coordinating with Linux distribution vendors for timely patches and backports is essential. Finally, maintaining strict network segmentation and limiting exposure of critical Linux systems to untrusted networks can reduce attack surface.