CVE-2022-49493 is a high-severity vulnerability in the Linux kernel specifically affecting the ASoC (ALSA System on Chip) driver for the rt5645 audio codec. The issue arises from a logic error in the cleanup sequence during the removal of the rt5645 device. In the vulnerable code, the function rt5645_i2c_remove() cancels the jack_detect_work delayed work item before deleting the btn_check_timer timer. However, the timer handler rt5645_btn_check_callback() can re-queue the jack_detect_work while the cleanup is in progress. This race condition leads to a use-after-free scenario where the jack_detect_work is rescheduled after being canceled and potentially after its associated memory has been freed. The vulnerability is classified under CWE-416 (Use After Free). Exploitation requires local access with low privileges (PR:L) and no user interaction (UI:N), but the attack vector is local (AV:L), meaning the attacker must have local access to the system. The impact is critical as it allows an attacker to execute arbitrary code with elevated privileges, compromising confidentiality, integrity, and availability of the affected system. The patch corrects the cleanup order by calling del_timer_sync before cancel_delayed_work_sync, preventing the re-queuing of the canceled work and eliminating the race condition. No known exploits are reported in the wild yet, but the CVSS score of 7.8 reflects the high risk posed by this vulnerability if exploited.

For European organizations, this vulnerability poses a significant risk especially to those relying on Linux-based systems with the rt5645 audio codec driver, which is common in embedded devices, laptops, and some IoT devices. Successful exploitation could allow local attackers to escalate privileges, potentially leading to full system compromise. This could result in unauthorized access to sensitive data, disruption of services, and the deployment of persistent malware. Organizations in sectors such as finance, healthcare, telecommunications, and critical infrastructure, which often use Linux systems, could face operational disruptions and data breaches. The local attack vector limits remote exploitation but insider threats or compromised user accounts could leverage this vulnerability. Given the widespread use of Linux in European enterprises and government agencies, the vulnerability could have broad implications if not promptly mitigated.

European organizations should prioritize applying the official Linux kernel patches that reorder the cleanup operations in the rt5645 driver to eliminate the use-after-free condition. Systems should be updated to the latest stable kernel versions containing this fix. Additionally, organizations should audit their Linux systems to identify devices using the rt5645 codec and verify patch status. Employing strict access controls and monitoring for unusual local activity can reduce the risk of exploitation. For embedded and IoT devices where kernel updates may be delayed, consider isolating these devices on segmented networks and restricting local access. Implementing kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and Control Flow Integrity (CFI) can further mitigate exploitation risks. Finally, maintain robust endpoint detection and response (EDR) solutions to detect potential exploitation attempts.