CVE-2022-49424 is a vulnerability identified in the Linux kernel specifically within the MediaTek IOMMU (Input-Output Memory Management Unit) driver code. The issue arises from a NULL pointer dereference when the kernel attempts to print the device name (dev_name) of a larbdev device during the probing phase. The root cause is an invalid device tree setting where the larbdev pointer is NULL, causing device_link_add() to fail and subsequently leading to a kernel crash when dev_name is accessed. This vulnerability manifests as a denial-of-service condition due to a kernel panic triggered by the NULL pointer dereference. The problem occurs when the device tree source (DTS) incorrectly sets the IOMMU nodes, resulting in invalid inputs to the driver. The fix implemented involves failing the probe if larbdev is NULL, thereby preventing the kernel from dereferencing a NULL pointer and avoiding the crash. The vulnerability is specific to certain MediaTek hardware platforms using the affected Linux kernel versions, as indicated by the hardware name MT6873 in the logs. The crash stack trace shows the fault occurs in the mtk_iommu_probe_device function, confirming the issue is localized to the MediaTek IOMMU driver. There are no known exploits in the wild, and no CVSS score has been assigned yet. The vulnerability primarily impacts system stability and availability rather than confidentiality or integrity, as it causes kernel crashes under specific misconfiguration conditions rather than arbitrary code execution or privilege escalation.

For European organizations, the impact of CVE-2022-49424 is primarily related to system availability and reliability, particularly for those using Linux-based systems on MediaTek hardware platforms. Organizations deploying embedded systems, IoT devices, or specialized hardware running affected Linux kernels with MediaTek IOMMU drivers may experience unexpected kernel panics and system crashes if device tree configurations are incorrect or maliciously altered. This could lead to service disruptions, downtime, and potential operational impacts in critical environments such as telecommunications, industrial control systems, or consumer electronics. However, since exploitation requires specific hardware and misconfiguration, the threat surface is relatively narrow. The vulnerability does not appear to allow remote code execution or privilege escalation, limiting its use in targeted attacks. Nonetheless, organizations relying on MediaTek-based Linux devices should consider the risk of stability issues and potential denial-of-service conditions, which could affect service continuity and maintenance costs.

To mitigate CVE-2022-49424, European organizations should: 1) Ensure that Linux kernel versions are updated to include the patch that fails the probe when larbdev is NULL, thereby preventing kernel crashes. 2) Validate device tree configurations rigorously during development and deployment to avoid invalid IOMMU node settings that trigger the vulnerability. 3) Implement configuration management and automated testing to detect misconfigurations in device trees before production deployment. 4) For embedded and IoT devices using MediaTek hardware, coordinate with vendors to obtain firmware and kernel updates that address this issue. 5) Monitor kernel logs for signs of NULL pointer dereference crashes related to mtk_iommu_probe_device to detect potential misconfigurations or attempted exploitation. 6) Employ hardware and software inventory management to identify affected devices and prioritize patching efforts. 7) Consider network segmentation and access controls to limit exposure of vulnerable devices to untrusted networks, reducing the risk of accidental or malicious misconfiguration.