CVE-2022-49067 is a vulnerability in the Linux kernel specifically affecting the PowerPC architecture, particularly the 64-bit Book3E and 32-bit variants. The issue arises from incorrect validation of virtual addresses in the function virt_addr_valid(). On 64-bit Book3E systems, the vmalloc space starts at a high virtual address (0x8000000000000000). Due to the behavior of the __pa() macro, which translates virtual addresses to physical addresses, this high vmalloc address incorrectly maps to physical address zero. Consequently, virt_addr_valid() returns true for vmalloc addresses that should be invalid, as vmalloc addresses alias with valid page frame numbers (PFNs). This incorrect validation can cause kernel bugs, particularly with hardened usercopy operations that protect against kernel memory exposure. The vulnerability was demonstrated by a kernel BUG triggered when running ethtool on eth0, where the kernel detected an invalid memory exposure attempt and panicked. The root cause is that data allocated by vmalloc() is mistakenly considered valid by virt_addr_valid(), leading to unsafe memory operations and kernel crashes. The fix involves adding upper limit checks in virt_addr_valid() to ensure addresses above PAGE_OFFSET and below high_memory are correctly validated, preventing false positives for vmalloc space. For 32-bit PowerPC, a similar problem with high memory was previously fixed but caused regressions, so the current patch reverts that and applies more precise checks. The vulnerability does not affect 64-bit Book3S systems due to differences in address translation. This flaw is subtle and architecture-specific, impacting kernel memory management and potentially causing denial of service via kernel panic when certain ioctl operations are performed. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations running Linux on PowerPC 64-bit Book3E or 32-bit systems, this vulnerability could lead to unexpected kernel panics and denial of service conditions, especially when using network diagnostic tools like ethtool. This could disrupt critical infrastructure, telecommunications equipment, or embedded systems relying on affected Linux kernels. Confidentiality and integrity impacts are limited since the issue primarily causes kernel crashes rather than direct memory corruption or privilege escalation. However, the denial of service could affect availability of services, particularly in industrial, telecom, or research environments where PowerPC-based Linux systems are deployed. Organizations using hardened kernels with usercopy protections might experience stability issues or service interruptions. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to accidental or targeted triggering of kernel panics, impacting operational continuity.

European organizations should ensure that Linux kernels running on PowerPC 64-bit Book3E and 32-bit architectures are updated to include the patch that corrects virt_addr_valid() behavior. Since the vulnerability is architecture-specific, verifying system architecture is critical. Kernel upgrades should be prioritized in environments where ethtool or similar ioctl-based tools are used, as these can trigger the bug. Additionally, organizations should audit their use of vmalloc memory and hardened usercopy features to identify potential triggers. Testing kernel updates in staging environments before production deployment is recommended to avoid regressions. For embedded or specialized systems where kernel updates are delayed, consider restricting access to ioctl interfaces or limiting use of vulnerable tools as a temporary workaround. Monitoring kernel logs for BUG messages related to usercopy or virt_addr_valid() can help detect attempts to trigger the vulnerability. Collaboration with Linux distribution vendors to obtain timely patches and backports is essential for maintaining security and stability.