CVE-2022-48797 is a vulnerability identified in the Linux kernel related to the handling of NUMA (Non-Uniform Memory Access) balancing and copy-on-write (COW) page migration. The issue arises from improper logic in the kernel's memory management subsystem, specifically in the function change_pte_range(), which incorrectly uses page_mapcount() to decide whether a COW page should be NUMA-protected. This is problematic because page_mapcount() reflects the number of mappings a page has, which is not a reliable indicator for whether a page can be migrated or not, especially when pages are pinned for DMA operations by accelerators like Gaudi. The bug was introduced in commit 09854ba94c6a, which simplified the do_wp_page() function. When NUMA balancing is enabled, this faulty logic can cause memory corruption, particularly in workloads that do not use process affinity and rely on get_user_pages (GUP) to pin pages for DMA. The root cause is that the kernel attempts to migrate COW pages that have other references, which it should not do. The fix involves changing the condition to use page_count() instead of page_mapcount(), ensuring that pages with multiple references are not migrated, thus preventing corruption. Although the exact mechanism by which NUMA balancing changes page protections leading to spurious COW events is not fully understood, the patch corrects the nonsensical test and stabilizes the behavior. This vulnerability affects Linux kernel versions containing the problematic commit and is relevant for systems with NUMA balancing enabled and workloads involving pinned pages for DMA. No known exploits are reported in the wild as of now.

For European organizations, this vulnerability poses a risk primarily to servers and systems running Linux kernels with the affected commit and having NUMA balancing enabled. The impact is particularly significant for environments using hardware accelerators or devices that perform DMA operations requiring pinned memory pages, such as AI accelerators, network cards, or storage controllers. Memory corruption caused by improper NUMA page migration can lead to data integrity issues, application crashes, system instability, or kernel panics, potentially disrupting critical services. In high-availability or data-sensitive sectors like finance, healthcare, and telecommunications, such instability can result in operational downtime and data loss. Moreover, since the issue relates to kernel memory management, it could be exploited indirectly by attackers who gain local access to trigger conditions that cause corruption, although no direct exploit is known. European organizations relying on NUMA-enabled Linux systems with complex workloads should be aware of this risk, especially those deploying advanced hardware accelerators or running containerized or virtualized environments where process affinity is not strictly enforced.

To mitigate this vulnerability, European organizations should: 1) Apply the official Linux kernel patch that corrects the condition from page_mapcount() to page_count() in change_pte_range() as soon as it becomes available in their distribution's kernel updates. 2) Temporarily disable NUMA balancing if patching is not immediately feasible, especially on systems using hardware accelerators or pinned pages for DMA, to avoid triggering the corruption. 3) Enforce process affinity bindings to specific NUMA nodes for workloads involving pinned pages, which has been shown to prevent the issue. 4) Audit and monitor systems for unusual kernel errors, memory corruption symptoms, or crashes related to NUMA balancing and pinned memory usage. 5) Coordinate with hardware vendors to understand if their drivers or accelerators might be affected and require firmware or driver updates. 6) In virtualized environments, consider NUMA topology awareness and affinity settings to reduce exposure. These steps go beyond generic advice by focusing on the specific interaction between NUMA balancing, pinned pages, and process affinity that triggers the vulnerability.