CVE-2022-49082 is a high-severity use-after-free vulnerability in the Linux kernel's mpt3sas driver, which manages SAS (Serial Attached SCSI) storage devices. The flaw occurs in the function _scsih_expander_node_remove(), where the port field of the sas_expander structure is freed by a call to mpt3sas_transport_port_remove(). Subsequently, the code attempts to access this freed memory during an ioc_info() call, such as when the driver module is removed (e.g., via rmmod). This use-after-free is detected by Kernel Address Sanitizer (KASAN) as an invalid memory read, which can lead to kernel crashes or potentially allow an attacker to execute arbitrary code with kernel privileges. The root cause is improper handling of the port pointer lifecycle, which was fixed by introducing a local variable to store the port ID before freeing the port structure, ensuring no dereferencing of freed memory occurs. The vulnerability affects Linux kernel versions containing the specified commit hashes and is classified under CWE-416 (Use After Free). The CVSS v3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity but requiring local privileges and no user interaction. No known exploits are currently reported in the wild.

For European organizations, this vulnerability poses a significant risk especially to enterprises and data centers relying on Linux servers with SAS storage controllers using the mpt3sas driver. Exploitation could lead to kernel crashes causing denial of service or privilege escalation allowing attackers to gain full control over affected systems. This could compromise sensitive data confidentiality and integrity, disrupt critical business operations, and impact availability of services. Organizations running Linux-based infrastructure in sectors such as finance, healthcare, telecommunications, and government are particularly at risk due to the critical nature of their data and services. The vulnerability requires local access with low complexity, so insider threats or attackers who have gained limited access could leverage this flaw to escalate privileges. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially as the vulnerability is publicly disclosed and patched. The impact is heightened in environments where kernel module management and SAS storage devices are common, which includes many European enterprise IT environments.

European organizations should promptly apply the official Linux kernel patches that fix CVE-2022-49082. Since the fix involves changes to the mpt3sas driver code, updating to a patched kernel version is essential. Organizations should: 1) Identify all Linux systems using the mpt3sas driver, particularly those with SAS storage hardware. 2) Schedule and perform kernel updates during maintenance windows to minimize disruption. 3) Implement strict access controls to limit local user privileges and reduce the risk of exploitation by untrusted users. 4) Monitor kernel logs and system behavior for signs of use-after-free or memory corruption issues. 5) Employ kernel hardening techniques such as KASAN or other memory safety tools in testing environments to detect similar issues proactively. 6) Restrict module loading/unloading permissions to trusted administrators only, reducing the attack surface related to module removal operations. 7) Maintain up-to-date backups and incident response plans to quickly recover from potential exploitation or system crashes. These steps go beyond generic advice by focusing on the specific driver and kernel module management context of this vulnerability.