CVE-2022-48810 is a vulnerability identified in the Linux kernel related to improper locking in the multicast routing (ipmr and ip6mr) subsystems. Specifically, the issue arises because the function ip[6]mr_free_table() is called without first acquiring the RTNL (routing netlink) lock on certain failure paths. The RTNL lock is a critical synchronization mechanism used to protect network device and routing data structures from concurrent access. Failure to hold this lock before calling ip[6]mr_free_table() can lead to an assertion failure within the kernel, as indicated by the message "RTNL: assertion failed at net/core/dev.c (10367)". This assertion failure can cause a kernel panic or crash, resulting in denial of service (DoS) conditions. The vulnerability is rooted in the net/core/dev.c and net/ipv6/ip6mr.c source files, affecting the unregister_netdevice_many and multicast routing cleanup functions. The issue was discovered and fixed by ensuring the RTNL lock is acquired before calling ip[6]mr_free_table() on failure paths. The vulnerability affects Linux kernel versions around 5.16.0-syzkaller-11627-g422ee58dc0ef and likely other versions with similar multicast routing code. No known exploits are reported in the wild as of the publication date. The vulnerability does not appear to allow privilege escalation or arbitrary code execution but can cause system instability or crashes when triggered, potentially by malformed network packets or maliciously crafted multicast routing configurations. Exploitation would require local or privileged access to trigger the affected kernel code paths, as it involves kernel-level network namespace and multicast routing operations. The vulnerability is technical and specific to kernel networking internals, requiring detailed understanding of Linux kernel locking and multicast routing mechanisms to exploit or mitigate.

For European organizations, the primary impact of CVE-2022-48810 is the risk of denial of service due to kernel crashes on Linux systems running vulnerable kernel versions. This can disrupt critical services, especially in environments relying on multicast routing such as telecommunications, media streaming, or complex network infrastructures. Organizations using Linux servers for network infrastructure, cloud services, or virtualization platforms could experience outages or degraded performance. Since Linux is widely deployed across European enterprises, cloud providers, and government agencies, the vulnerability could affect a broad range of sectors including finance, healthcare, public administration, and industrial control systems. The lack of known exploits reduces immediate risk, but the potential for accidental crashes or targeted DoS attacks remains. The vulnerability does not directly compromise confidentiality or integrity but impacts availability, which can have cascading effects on business operations and service delivery. Organizations with strict uptime requirements or those operating critical infrastructure should prioritize patching to avoid service interruptions. Additionally, the vulnerability could be leveraged in multi-tenant cloud environments to disrupt co-located workloads if exploited by malicious tenants with sufficient privileges.

1. Apply the official Linux kernel patches that address CVE-2022-48810 as soon as they become available from trusted sources or Linux distribution vendors. 2. Upgrade to a Linux kernel version that includes the fix for this vulnerability, preferably from the latest stable releases or vendor-supported kernels. 3. For environments where immediate patching is not feasible, consider disabling or restricting multicast routing features if they are not required, to reduce the attack surface. 4. Implement strict access controls and monitoring on systems that handle multicast routing or network namespace operations to detect unusual or unauthorized activities. 5. Use kernel lockdown features or security modules (e.g., SELinux, AppArmor) to limit the ability of unprivileged users to interact with network namespaces or routing configurations. 6. In cloud or virtualized environments, isolate workloads and enforce tenant privilege separation to prevent exploitation by malicious actors with limited access. 7. Regularly audit and monitor kernel logs for RTNL assertion failures or related kernel warnings that could indicate attempted exploitation or instability. 8. Maintain comprehensive backup and recovery plans to quickly restore services in case of crashes or DoS incidents caused by this vulnerability.