CVE-2022-49198 is a vulnerability identified in the Linux kernel's implementation of Multipath TCP (MPTCP), a protocol extension that allows a single TCP connection to use multiple paths to maximize resource usage and increase redundancy. The flaw arises from improper handling of socket buffer (skb) memory during transmission under memory pressure conditions. Specifically, when the kernel allocates a transmission skb in the __mptcp_alloc_tx_skb function, it initializes the tcp_tsorted_anchor structure within the skb. However, if the system is under memory pressure, the function sk_wmem_schedule may fail, triggering a call to kfree_skb to free the skb. Because skb->_skb_refdst and tcp_tsorted_anchor share the same memory, kfree_skb attempts to release a destination reference that has already been freed or is in an inconsistent state, leading to a kernel crash (kernel panic) due to a use-after-free or double free scenario. The crash manifests as a kernel paging request error and an invalid reference count on the destination object, as evidenced by the kernel oops logs. This vulnerability can be triggered during stress or pressure testing of MPTCP connections, causing denial of service (DoS) by crashing the kernel. While no known exploits are reported in the wild, the vulnerability is significant because it affects the core Linux kernel networking stack, potentially impacting any system using MPTCP. The issue was resolved by correcting the order of initialization and release of tcp_tsorted_anchor and skb references to prevent premature freeing and consequent crashes.

For European organizations, the impact of CVE-2022-49198 primarily involves potential denial of service conditions on Linux-based systems utilizing MPTCP. This includes servers, network appliances, and cloud infrastructure that leverage MPTCP for enhanced network resilience and throughput. A kernel crash can lead to system downtime, loss of availability of critical services, and potential disruption of business operations. In environments where high availability is essential—such as financial institutions, telecommunications providers, and critical infrastructure operators—such disruptions could have significant operational and reputational consequences. Additionally, while no direct code execution or privilege escalation is indicated, repeated crashes could be leveraged by attackers to cause persistent denial of service or to create conditions favorable for further exploitation. European organizations relying on Linux kernels with affected versions, especially those deploying MPTCP in production or testing environments, should be aware of the risk of unexpected system crashes under network load or memory pressure.

To mitigate CVE-2022-49198, European organizations should: 1) Apply the latest Linux kernel patches that address this vulnerability as soon as they become available, ensuring that the fix for the skb and tcp_tsorted_anchor handling is included. 2) Audit and monitor systems that utilize MPTCP, particularly those under heavy network load or memory pressure, to detect abnormal kernel crashes or oops messages indicative of this issue. 3) If immediate patching is not feasible, consider disabling MPTCP functionality temporarily to prevent triggering the vulnerability, especially in production environments. 4) Implement robust kernel crash recovery and monitoring mechanisms to minimize downtime and facilitate rapid incident response. 5) Conduct thorough testing of network stack behavior under stress conditions in controlled environments to identify any residual instability. 6) Maintain up-to-date inventories of Linux kernel versions deployed across infrastructure to prioritize patching efforts effectively.