CVE-2022-49087 is a high-severity vulnerability in the Linux kernel's rxrpc subsystem, specifically involving a race condition in the rxrpc_exit_net() function. The vulnerability arises due to improper synchronization between the network namespace cleanup function rxrpc_exit_net() and the peer keepalive worker thread rxrpc_peer_keepalive_worker(). The race condition occurs when rxrpc_exit_net() sets the rxnet->live flag to false and deletes the peer_keepalive_timer while the peer_keepalive_worker may still be accessing or modifying the timer. This leads to a use-after-free condition where the timer object is accessed after it has been freed, potentially causing kernel crashes or arbitrary code execution. The issue was identified through syzbot fuzzing reports, which detected freeing of active timer objects and kernel warnings related to debug objects. The vulnerability is classified under CWE-416 (Use After Free) and affects multiple Linux kernel versions identified by the commit hash ace45bec6d77bc061c3c3d8ad99e298ea9800c2b. The CVSS 3.1 base score is 7.8, reflecting a high severity with local attack vector, low attack complexity, requiring privileges, no user interaction, and impacting confidentiality, integrity, and availability. Exploitation requires local privileges but can lead to significant kernel-level compromise. No known exploits in the wild have been reported yet. The vulnerability impacts the Linux kernel's network namespace cleanup process, which is critical for containerized and virtualized environments that heavily rely on network namespaces. The race condition can be triggered during network namespace teardown, potentially allowing attackers with local access to cause denial of service or escalate privileges by executing arbitrary code in kernel space.

For European organizations, the impact of CVE-2022-49087 can be significant, especially for those relying on Linux-based infrastructure, including servers, cloud environments, and container orchestration platforms such as Kubernetes. Many European enterprises and service providers use Linux extensively for critical applications and network services. The vulnerability could allow an attacker with local access—such as a malicious insider, compromised user account, or attacker exploiting another vulnerability—to cause kernel crashes leading to denial of service or potentially escalate privileges to gain full control over affected systems. This poses risks to data confidentiality, integrity, and availability. Given the widespread use of Linux in European data centers, telecom infrastructure, and government systems, exploitation could disrupt essential services and lead to data breaches or operational downtime. The vulnerability is particularly relevant for organizations using network namespaces for container isolation, common in DevOps and cloud-native deployments. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, as attackers may develop exploits once patches are widely deployed. Therefore, European organizations must prioritize patching and mitigation to protect critical infrastructure and sensitive data.

1. Apply official Linux kernel patches that address CVE-2022-49087 as soon as they become available from trusted sources or Linux distribution vendors. 2. For environments using containerization or network namespaces, carefully schedule kernel updates to minimize disruption and ensure compatibility. 3. Implement strict access controls to limit local user privileges, reducing the risk that an attacker can trigger the race condition. 4. Monitor kernel logs and system behavior for signs of crashes or anomalies related to rxrpc or network namespace cleanup activities. 5. Use kernel hardening features such as Kernel Address Space Layout Randomization (KASLR), Kernel Page Table Isolation (KPTI), and seccomp filters to reduce exploitation likelihood. 6. Employ runtime security tools that can detect use-after-free or memory corruption attempts in kernel space. 7. In multi-tenant or cloud environments, isolate workloads and enforce strict tenant separation to prevent lateral movement by attackers with local access. 8. Maintain up-to-date backups and incident response plans to quickly recover from potential exploitation. 9. Engage with Linux distribution security advisories and subscribe to vulnerability notifications to stay informed about patch releases and exploit developments.