CVE-2022-48942 is a vulnerability identified in the Linux kernel's hardware monitoring (hwmon) subsystem, specifically related to the handling of sensor registration failures with thermal zones. The vulnerability arises when the function devm_thermal_zone_of_sensor_register() fails to register a sensor with a thermal zone and returns the error code -ENODEV. The hwmon core does not properly handle this failure, which can lead to a NULL pointer dereference in the kernel. This results in a kernel crash (kernel oops) due to attempts to access invalid memory addresses, as demonstrated by the provided kernel stack trace. The crash occurs during the call sequence involving hwmon_notify_event(), hwmon_thermal_notify(), thermal_zone_device_update(), update_temperature(), and mutex_lock(). The root cause is the lack of error handling for the sensor registration failure, causing the system to dereference a NULL pointer when it assumes the sensor was successfully attached to a thermal zone. The fix involves modifying the hwmon core to correctly handle the -ENODEV error by reporting that the sensor was not attached to a thermal zone but continuing to register the hwmon device without causing a crash. This vulnerability affects Linux kernel versions identified by the provided commit hashes and is present in systems that utilize the hwmon subsystem for thermal sensor management. No known exploits are reported in the wild at this time.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions with hardware monitoring enabled, especially those relying on thermal sensors for system health and temperature management. A kernel crash caused by this vulnerability can lead to system instability, unexpected reboots, or denial of service (DoS), impacting availability of critical infrastructure, servers, or embedded devices. Organizations operating data centers, cloud services, or industrial control systems using Linux-based platforms may experience service disruptions. Although this vulnerability does not directly lead to privilege escalation or data leakage, the resulting denial of service can affect business continuity and operational reliability. In sectors such as finance, healthcare, manufacturing, and telecommunications, where Linux servers are prevalent, such disruptions can have significant operational and financial consequences. Additionally, the inability to properly monitor thermal conditions could lead to hardware damage if temperature anomalies go undetected, further increasing risk.

European organizations should prioritize updating their Linux kernel to the patched versions that include the fix for CVE-2022-48942. Specifically, they should apply the latest stable kernel releases or backported patches from their Linux distribution vendors that address the hwmon sensor registration error handling. System administrators should audit their environments to identify systems running vulnerable kernel versions with hwmon enabled. For embedded or specialized Linux systems, firmware or kernel updates should be coordinated with hardware vendors. Additionally, organizations should implement robust monitoring and alerting for kernel oops and system crashes to detect potential exploitation attempts or instability early. Where immediate patching is not feasible, consider disabling or limiting hwmon thermal sensor registration if it does not impact critical operations, as a temporary mitigation. Finally, maintain regular backups and ensure rapid recovery procedures are in place to minimize downtime in case of crashes.