CVE-2022-49400 is a vulnerability in the Linux kernel's MD (multiple device) RAID subsystem, specifically affecting the handling of RAID0 devices during reshape operations. The issue arises from improper management of the mddev->private pointer during the stop and reshape processes of RAID0 arrays. Normally, when stopping a RAID device, the kernel calls a sequence of functions culminating in __md_stop, which invokes the pers->free() callback and then sets mddev->private to NULL before freeing the mddev structure. However, during a reshape operation, the kernel sets mddev->private to a new persistence structure (new_pers) before calling old_pers->free(), but RAID0 incorrectly sets mddev->private to NULL in raid0_free. This leads to a NULL pointer dereference when the new RAID attempts to access mddev->private, causing a kernel panic and system crash. The vulnerability manifests as a kernel BUG triggered by dereferencing a NULL pointer in the RAID10 driver code path during resynchronization, as evidenced by the provided kernel panic logs. The root cause is the premature clearing of mddev->private in raid0_free during reshape, which disrupts the new RAID's operation. The fix involves removing the code that sets mddev->private to NULL in raid0_free, ensuring the pointer remains valid throughout the reshape process. This vulnerability affects Linux kernel versions identified by specific commit hashes listed, and it is relevant to systems using software RAID0 configurations. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations relying on Linux-based servers with software RAID0 configurations, this vulnerability poses a risk of unexpected system crashes and downtime due to kernel panics triggered during RAID reshape operations. RAID0, while less commonly used for critical data due to lack of redundancy, is still employed for performance-sensitive applications. A kernel panic can lead to loss of availability, potential data corruption if writes are interrupted, and operational disruption. Organizations running critical infrastructure, data centers, or cloud services on affected Linux kernels may experience service outages. The impact is primarily on availability and system stability rather than confidentiality or integrity. Since the vulnerability requires a RAID reshape operation to trigger, the attack surface is somewhat limited, but inadvertent or malicious triggering of reshape could cause denial of service. European enterprises with high reliance on Linux servers in finance, telecommunications, manufacturing, or public sector could face operational risks if unpatched. Additionally, recovery from kernel panics in production environments can be complex and time-consuming, increasing downtime costs.

1. Apply the official Linux kernel patches that address CVE-2022-49400 as soon as they become available from trusted sources or Linux distribution vendors. 2. Avoid performing RAID0 reshape operations on production systems until patched, or schedule maintenance windows with backups in place. 3. Implement monitoring to detect kernel panics and RAID reshape events to respond quickly to potential issues. 4. For systems where RAID0 is not essential, consider migrating to RAID levels with redundancy (e.g., RAID1 or RAID10) to reduce risk. 5. Maintain regular backups of data on RAID0 arrays to mitigate data loss risks from unexpected crashes. 6. Test kernel updates in staging environments to verify stability before deployment. 7. Limit access to systems capable of triggering RAID reshape operations to trusted administrators to reduce accidental or malicious triggering. 8. Review and update incident response plans to include procedures for kernel panic recovery and RAID subsystem troubleshooting.