CVE-2022-49476 is a vulnerability in the Linux kernel specifically related to the mt76 wireless driver for the MediaTek MT7921 Wi-Fi chipset. The issue arises from a race condition during the removal of the PCI device, where the interrupt handler (mt7921_irq_handler) may be invoked concurrently while the device's IRQs are being freed (devm_free_irq). This leads to a premature freeing of the mt76 device structure before the IRQ handler has completed, causing a NULL pointer dereference and a kernel crash. The crash logs indicate a supervisor read access fault at a NULL pointer offset, which is symptomatic of use-after-free or dereferencing freed memory. The root cause is that the freeing of the mt76 device is not properly synchronized with the IRQ freeing process, resulting in the kernel attempting to access invalid memory. This vulnerability can cause system instability and denial of service (DoS) conditions due to kernel panics or oops events. The flaw affects Linux kernel versions containing the vulnerable mt76 driver implementation, notably around kernel version 5.15.14 as per the example log. The patch involves postponing the freeing of the mt76 device until after devm_free_irq completes, ensuring proper synchronization and preventing the race condition. There are no known exploits in the wild, and no CVSS score has been assigned yet. The vulnerability is primarily a stability and availability issue rather than a direct confidentiality or integrity compromise vector.

For European organizations, the impact of CVE-2022-49476 centers on system availability and reliability, especially for those relying on Linux-based systems with MediaTek MT7921 Wi-Fi chipsets. This includes servers, desktops, laptops, and embedded devices running vulnerable kernel versions. A kernel crash triggered by this vulnerability can lead to unexpected reboots or system downtime, disrupting business operations, critical services, or industrial control systems. Organizations with large-scale Linux deployments in networking, telecommunications, or IoT sectors may face increased risk of service interruptions. While this vulnerability does not appear to allow privilege escalation or remote code execution, the denial of service potential could be exploited by local attackers or automated processes to degrade system performance or availability. In environments where uptime and stability are critical, such as financial institutions, healthcare providers, or public infrastructure, this vulnerability could have significant operational consequences. Additionally, the vulnerability may complicate maintenance and patching cycles if devices require frequent reboots or manual intervention after crashes.

To mitigate CVE-2022-49476, European organizations should: 1) Identify and inventory all Linux systems using the MediaTek MT7921 wireless chipset and verify kernel versions for vulnerability. 2) Apply the latest Linux kernel updates or patches that address this specific mt76 driver race condition as soon as they become available. If official patches are not yet released, consider backporting the fix from the mainline kernel or applying vendor-provided patches. 3) Implement strict change management and testing procedures to ensure kernel updates do not disrupt critical services. 4) Where possible, disable or remove the mt7921 wireless device if it is not essential, to eliminate the attack surface. 5) Monitor system logs for kernel oops or crash messages related to mt7921_irq_handler to detect potential exploitation or instability. 6) For virtualized environments (e.g., Xen HVM domU as in the example), ensure hypervisor and guest kernel compatibility and updates to prevent cascading failures. 7) Educate system administrators about the symptoms and recovery procedures related to this vulnerability to minimize downtime. These steps go beyond generic advice by focusing on chipset-specific mitigation, proactive detection, and operational continuity.