CVE-2022-49007 is a vulnerability in the Linux kernel affecting the NILFS2 (New Implementation of a Log-structured File System) component. The issue arises from a NULL pointer dereference in the function nilfs_palloc_commit_free_entry(), which is triggered during certain b-tree operations on the NILFS2 filesystem metadata. Specifically, if the DAT (Disk Address Translation) metadata file is corrupted, the req->pr_desc_bh pointer can be NULL while the block number is zero during nilfs_dat_commit_end(). This leads to nilfs_dat_commit_free() being called with invalid buffer heads, causing a NULL pointer dereference and kernel crash (general protection fault). The root cause is that nilfs_dat_commit_alloc() can initialize the block number on the same DAT entry between nilfs_dat_prepare_end() and nilfs_dat_commit_end(), creating a race condition or inconsistent state when metadata is corrupted. The fix involves adding NULL checks on req->pr_desc_bh and req->pr_bitmap_bh before calling nilfs_palloc_commit_free_entry(), and invoking nilfs_error() to log the fatal filesystem metadata flaw and prevent further operations. This vulnerability was discovered by Syzbot and affects Linux kernel versions including the 6.1.0-rc2 release candidate. It does not require user interaction but depends on the presence of corrupted NILFS2 metadata, which may occur due to disk errors or malicious tampering. Exploitation leads to a denial of service via kernel crash, impacting system availability. No known exploits are reported in the wild as of the publication date.

For European organizations, the primary impact of CVE-2022-49007 is a potential denial of service (DoS) condition on systems using the NILFS2 filesystem. While NILFS2 is not as widely deployed as ext4 or XFS, it is used in some specialized environments requiring log-structured filesystems, such as certain embedded systems or high-throughput storage scenarios. A kernel crash caused by this vulnerability could disrupt critical services, especially in data centers or cloud environments running Linux kernels vulnerable to this issue. The crash could lead to system reboots, data unavailability, or potential data corruption if the filesystem metadata is already compromised. Since the vulnerability is triggered by corrupted metadata, it may also indicate underlying hardware or storage issues, compounding operational risks. European organizations relying on Linux-based infrastructure with NILFS2 should be aware that this vulnerability could affect system stability and availability, potentially impacting sectors like telecommunications, finance, or public services where uptime is critical. However, the impact is limited by the relatively niche use of NILFS2 and the requirement of corrupted metadata to trigger the fault.

1. Immediate patching: Apply the official Linux kernel patches that address CVE-2022-49007 as soon as they become available. Monitor kernel updates from trusted Linux distributions and vendors. 2. Filesystem integrity checks: Regularly run filesystem consistency checks (fsck) on NILFS2 volumes to detect and repair metadata corruption proactively, reducing the chance of triggering this vulnerability. 3. Hardware health monitoring: Implement robust disk health monitoring and predictive failure analysis to prevent metadata corruption caused by hardware faults. 4. Backup and recovery: Maintain up-to-date backups of critical data on NILFS2 filesystems to enable recovery in case of corruption or crashes. 5. Limit NILFS2 usage: Where possible, evaluate the necessity of using NILFS2 and consider migrating to more widely supported and tested filesystems like ext4 or XFS, which do not have this vulnerability. 6. Kernel hardening: Employ kernel hardening techniques and security modules that can mitigate the impact of kernel crashes or isolate faulty components. 7. Logging and alerting: Enhance monitoring to detect kernel crashes and filesystem errors promptly, enabling rapid incident response.