CVE-2022-49034 addresses a vulnerability in the Linux kernel related to the handling of CPU information display when specific kernel configuration options are enabled. The issue arises when both CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected in the kernel configuration. Under these conditions, the function cpu_max_bits_warn() generates a runtime warning during the display of /proc/cpuinfo, which is a virtual file providing detailed CPU information. The root cause is the use of a static constant NR_CPUS to iterate over CPUs instead of the runtime variable nr_cpu_ids, which reflects the actual number of CPUs present. This mismatch leads to warnings and potential instability as the kernel attempts to access CPU data beyond the actual CPU count. The warning is evidenced by kernel log messages indicating a CPU warning trace, including stack traces pointing to show_cpuinfo and related functions. The fix involves modifying the iteration logic to use nr_cpu_ids, thereby preventing the runtime warning and ensuring accurate CPU information reporting. This vulnerability is not associated with any known exploits in the wild and does not have a CVSS score assigned. It primarily affects Linux kernel versions compiled with the specified configuration options, which are typically used for debugging and development purposes rather than in standard production environments.

For European organizations, the impact of this vulnerability is generally low. The issue manifests as a runtime warning rather than a security breach or system compromise. It does not allow for privilege escalation, code execution, or denial of service directly. However, in environments where kernel debugging features are enabled—such as development, testing, or specialized embedded systems—this warning could lead to confusion, increased log noise, or minor stability issues. In critical infrastructure or high-availability systems relying on customized kernels with these options enabled, the warning might complicate system monitoring or diagnostics. Since the vulnerability does not expose sensitive data or provide an attack vector, the confidentiality, integrity, and availability of systems are largely unaffected. Nonetheless, organizations should be aware of the potential for misleading kernel warnings that could mask other issues or complicate troubleshooting.

To mitigate this issue, European organizations should: 1) Ensure Linux kernels are updated to versions where this vulnerability is fixed, specifically kernels that have adopted the patch replacing NR_CPUS with nr_cpu_ids in the show_cpuinfo function. 2) Review kernel configuration options and disable CONFIG_DEBUG_PER_CPU_MAPS and CONFIG_CPUMASK_OFFSTACK unless explicitly required for debugging or development, as these options are not commonly needed in production. 3) Implement rigorous kernel update policies to promptly apply security and stability patches. 4) Monitor kernel logs for warnings related to CPU information and investigate any anomalies to prevent misinterpretation of system health. 5) For custom or embedded Linux distributions, coordinate with vendors or maintainers to incorporate the fix in their kernel builds. 6) Educate system administrators about the nature of this warning to avoid unnecessary alarm and to focus on genuine security or stability issues.