CVE-2022-49412 is a high-severity vulnerability in the Linux kernel's BFQ (Budget Fair Queueing) I/O scheduler. The flaw arises from improper handling of queue merging when the parent cgroup of a bfqq (BFQ queue) changes between the decision to merge two queues and the actual merge operation. Specifically, the vulnerability occurs because the parent of a bfqq can be reparented due to changes in the cgroup associated with the process submitting I/O. This can lead to a use-after-free condition if the bfqq being merged has a parent cgroup that is offline and scheduled for destruction. The use-after-free manifests as a kernel memory corruption, which can cause system instability, crashes (kernel panics), or potentially allow an attacker to execute arbitrary code with kernel privileges. The vulnerability is tracked as CWE-416 (Use After Free). The technical root cause is that the BFQ scheduler does not verify that the parents of the two bfqqs remain the same at the time of merging, leading to unsafe memory access. The fix involves adding a check in bfq_setup_merge() to ensure that the parents of the bfqqs are identical before merging. The CVSS v3.1 score is 7.8 (high), reflecting local attack vector, low attack complexity, requiring privileges but no user interaction, and impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild yet. The vulnerability affects Linux kernel versions prior to the patch and is relevant to systems using the BFQ I/O scheduler, which is common in many Linux distributions, including those used in enterprise and cloud environments.

For European organizations, this vulnerability poses a significant risk especially for servers and infrastructure running Linux kernels with the BFQ scheduler enabled. Exploitation can lead to kernel crashes causing denial of service, or potentially privilege escalation allowing attackers to gain root access. This is critical for data centers, cloud providers, and enterprises relying on Linux for critical workloads, as it can compromise confidentiality, integrity, and availability of sensitive data and services. The vulnerability could be exploited by local attackers or compromised processes with limited privileges, including containerized environments (e.g., Docker, Kubernetes) where processes run with restricted permissions but share the kernel. Given the widespread use of Linux in European public sector, finance, telecommunications, and industrial control systems, the impact could be broad. Additionally, disruption of critical infrastructure or cloud services could have cascading effects on dependent businesses and services across Europe.

European organizations should promptly apply the official Linux kernel patches that address CVE-2022-49412. If immediate patching is not feasible, mitigating controls include disabling the BFQ I/O scheduler or switching to alternative schedulers such as CFQ or deadline, where appropriate. Organizations should audit their Linux systems to identify usage of the BFQ scheduler, especially on critical servers and container hosts. Implement strict access controls to limit local user privileges and container escape risks. Monitoring kernel logs for signs of use-after-free errors or kernel panics can help detect exploitation attempts. Additionally, organizations should ensure that cgroup configurations are properly managed to avoid unexpected reparenting scenarios. Regular vulnerability scanning and integration of kernel updates into patch management workflows are essential. For cloud environments, coordinate with providers to confirm kernel patch status and scheduler configurations.