CVE-2022-48845 is a vulnerability identified in the Linux kernel specifically affecting the MIPS architecture with the CONFIG_SCHED_CORE scheduler feature enabled. The issue arises from the improper initialization timing of CPU sibling and core maps during CPU startup sequences. In affected kernel versions, the sibling mask (smt_mask), which represents the logical CPUs sharing the same physical core, is left empty when the sched_core_cpu_starting() function is invoked. This function is responsible for calculating core-scheduling parameters and is triggered as a CPU hotplug callback during CPU startup. The root cause is that the set_cpu_sibling_map() function, which populates the sibling map, is called after notify_cpu_start(), whereas sched_core_cpu_starting() expects this data to be available beforehand. This results in warnings and potential misbehavior in CPU scheduling on multi-core, multi-threaded MIPS processors, particularly those using the interAptiv architecture. The flaw was introduced after enabling CONFIG_SCHED_CORE in kernel version 5.14 and manifests as kernel warnings and potential instability during CPU initialization. The fix involves adjusting the order of sibling map initialization to occur earlier in the CPU startup process, ensuring that sched_core_cpu_starting() has accurate sibling information. This vulnerability is specific to MIPS architectures with certain CPU topologies and scheduler configurations and does not affect other architectures like x86 or ARM64, which handle sibling map initialization differently. No known exploits are reported in the wild, and the vulnerability primarily causes kernel warnings and potential CPU scheduling misconfigurations rather than direct security breaches.

For European organizations, the impact of CVE-2022-48845 is relatively limited due to the niche nature of the affected platform—MIPS architecture CPUs with CONFIG_SCHED_CORE enabled in the Linux kernel. Most mainstream servers, desktops, and cloud infrastructure in Europe run on x86_64 or ARM architectures, which are not affected by this issue. However, organizations using embedded systems, network appliances, or specialized industrial control systems based on MIPS processors could experience kernel instability or degraded CPU scheduling performance. This could lead to reduced system reliability or availability in critical infrastructure or telecommunications equipment. Although no direct security exploit is known, the vulnerability could indirectly affect system integrity by causing unexpected CPU behavior or kernel panics during CPU hotplug events or system boot. This might impact sectors relying on MIPS-based embedded Linux devices, such as telecommunications providers, industrial automation firms, or certain IoT deployments prevalent in Europe. Overall, the threat to confidentiality and integrity is low, but availability and system stability could be moderately impacted in affected environments.

To mitigate CVE-2022-48845, organizations should: 1) Apply the latest Linux kernel patches that reorder the initialization of CPU sibling maps to occur before CPU hotplug callbacks, ensuring CONFIG_SCHED_CORE functionality operates correctly. 2) For embedded or specialized MIPS-based systems, coordinate with hardware and OS vendors to obtain updated firmware or kernel versions incorporating this fix. 3) Disable CONFIG_SCHED_CORE if not required, as this scheduler feature is the trigger for the vulnerability. 4) Implement rigorous testing of kernel updates in staging environments for MIPS-based devices to detect any CPU startup or scheduling anomalies before production deployment. 5) Monitor kernel logs for warnings related to sched_core_cpu_starting or CPU sibling map initialization to detect potential residual issues. 6) Maintain inventory of MIPS-based Linux systems within the organization to assess exposure and prioritize patching. These steps go beyond generic advice by focusing on architecture-specific configurations and emphasizing proactive vendor coordination and monitoring tailored to embedded and specialized Linux deployments.