CVE-2022-49065 is a vulnerability identified in the Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem, specifically related to the svc_deferred_event trace class. The issue arises when an svc_rqst (service request) is deferred while the sunrpc tracing subsystem is enabled, leading to a NULL pointer dereference crash. This occurs because the function svc_revisit() sets the dr->xprt pointer to NULL, which is then improperly accessed in the tracepoint code to retrieve the remote address. The vulnerability is rooted in unsafe dereferencing of a struct sockaddr pointer within the tracepoint's event format specifiers, flagged by kernel tracing format checks. The fix involves converting the dr::addr field into a presentation address string during the TP_fast_assign() phase of the trace event, avoiding direct dereferencing of a potentially NULL pointer. This approach is a workaround until a more elegant fix using the __sockaddr() macro is integrated in kernel version 5.19. The vulnerability can cause a kernel crash (NULL pointer dereference), leading to denial of service conditions on affected Linux systems running vulnerable kernel versions. The issue affects specific commits identified by the hash ece200ddd54b9ce840cfee554fb812560c545c7d and is relevant to stable kernel branches where the SUNRPC tracing subsystem is enabled. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet. The vulnerability is technical and requires kernel-level tracing features to be enabled, which may limit exposure to certain environments where tracing is actively used for debugging or monitoring RPC calls.

For European organizations, the primary impact of CVE-2022-49065 is the potential for denial of service due to kernel crashes on Linux systems utilizing the SUNRPC tracing subsystem. This could affect critical infrastructure, servers, and networked applications relying on Linux kernels with the vulnerable commits, especially those using RPC services extensively. Organizations running high-availability services or cloud infrastructure with Linux kernels that have tracing enabled could experience service interruptions. While the vulnerability does not appear to allow privilege escalation or remote code execution, the denial of service impact could disrupt business operations, particularly in sectors such as telecommunications, finance, government, and cloud service providers where Linux is prevalent. The absence of known exploits reduces immediate risk, but the vulnerability should be addressed proactively to maintain system stability and reliability. Additionally, the requirement for tracing to be enabled means that many default Linux installations may not be vulnerable unless tracing features are explicitly activated.

European organizations should apply the available patches or kernel updates that address this vulnerability as soon as they are released. Specifically, updating to Linux kernel versions that include the fix converting dr::addr to a presentation string in the tracepoint assignment is critical. For environments where kernel tracing is not required, disabling the sunrpc tracing subsystem can mitigate exposure. System administrators should audit their kernel configurations to verify if tracing is enabled and assess the necessity of this feature. In production environments, thorough testing of kernel updates should be conducted to ensure stability. Monitoring kernel logs for svc_deferred_event related errors or crashes can help detect attempts to trigger this vulnerability. Additionally, organizations should maintain robust backup and recovery procedures to minimize downtime in case of crashes. Given the technical nature of the fix, collaboration with Linux distribution vendors to obtain backported patches for stable kernel versions is recommended to ensure timely remediation.