CVE-2022-49069 is a vulnerability identified in the Linux kernel, specifically within the Direct Rendering Manager (DRM) subsystem for AMD graphics hardware. The flaw relates to the drm/amd/display driver component, where the function dcn30_internal_validate_bw improperly handles floating point unit (FPU) context during bandwidth validation calculations. The vulnerability manifests as a general protection fault (GPF) triggered by non-canonical memory addresses during prolonged execution of WebGL Aquarium, particularly when DRM debug logs are enabled at a high verbosity level (0x1f). The root cause is the lack of proper FPU protection around the use of floating point operations in the populate_dml_pipes function, which initializes double precision floating point values. Without FPU protection, context switches can lead to loss or corruption of the FPU state (vba context), causing kernel faults and system instability. The issue is reproducible within approximately 10 minutes under the specified conditions. The patch involves adding FPU protection to the affected code path to prevent context switch interference during floating point operations. This vulnerability does not appear to have known exploits in the wild and affects specific Linux kernel versions identified by commit hashes. No CVSS score has been assigned yet.

For European organizations, this vulnerability primarily threatens the stability and reliability of Linux systems running AMD GPU drivers under workloads involving graphics-intensive applications or WebGL content, especially when DRM debug logging is enabled. The general protection fault can cause kernel panics or system crashes, leading to denial of service (DoS) conditions. While it does not directly expose confidentiality or integrity risks, the availability impact can disrupt critical services, particularly in environments relying on Linux servers or workstations with AMD GPUs for rendering or compute tasks. Organizations in sectors such as media production, scientific computing, or cloud service providers using AMD hardware could experience operational interruptions. The vulnerability's requirement for debug logging to be enabled at a high level reduces the likelihood of widespread exploitation but does not eliminate the risk of accidental or targeted triggering in debug or development environments. Given the Linux kernel's widespread use across European industries and governments, the vulnerability's impact on system uptime and reliability is significant, especially where kernel stability is critical.

European organizations should apply the official Linux kernel patches that add FPU protection around the dcn30_internal_validate_bw function as soon as they become available from trusted Linux distribution vendors or the mainline kernel. Until patched, it is advisable to disable or reduce the verbosity of DRM debug logging to avoid triggering the fault. System administrators should monitor kernel logs for signs of general protection faults related to AMD GPU drivers and consider limiting the use of WebGL Aquarium or similar graphics-intensive workloads in affected environments. For environments where AMD GPU usage is critical, testing kernel updates in staging before production deployment is recommended to ensure stability. Additionally, organizations should maintain up-to-date kernel versions and subscribe to Linux kernel security advisories to receive timely updates. Employing kernel live patching solutions where available can reduce downtime during patch application. Finally, auditing and restricting access to debug logging settings can prevent inadvertent enabling of conditions that trigger the fault.