CVE-2022-49496 is a vulnerability identified in the Linux kernel specifically affecting the MediaTek video codec driver module, mtk-vcodec-dec.ko. The issue arises when the driver operates in sub-device (subdev) mode, where the parameter "dev->pm.dev" can be NULL during the removal (rmmod) of the mtk-vcodec-dec kernel module. This NULL pointer dereference leads to a kernel crash due to improper handling in the mtk_vcodec_dec_remove function. The crash occurs when the kernel attempts to disable runtime power management (__pm_runtime_disable) on a NULL device pointer, triggering a spinlock operation on invalid memory, which results in a system panic or kernel oops. The provided kernel stack trace shows the crash path starting from do_raw_spin_trylock, progressing through __pm_runtime_disable, and culminating in the module removal sequence. This vulnerability is a stability and availability issue rather than a direct code execution or privilege escalation flaw. It affects Linux kernel versions containing the vulnerable MediaTek video codec driver implementation, particularly on ARM64 architectures where MediaTek SoCs are common. No public exploits are known at this time, and no CVSS score has been assigned. The vulnerability was disclosed and published in early 2025, with no patch links provided in the data, indicating that users should verify kernel updates from Linux distributions or MediaTek for remediation.

For European organizations, the primary impact of CVE-2022-49496 is on system availability and stability. Systems running Linux kernels with the vulnerable MediaTek video codec driver may experience kernel crashes when the affected module is removed, potentially causing unplanned downtime or service interruptions. This is particularly relevant for embedded systems, IoT devices, or specialized hardware using MediaTek SoCs with Linux-based firmware. Enterprises relying on such devices for critical operations—such as telecommunications infrastructure, industrial control systems, or multimedia processing units—may face operational disruptions. Although this vulnerability does not directly lead to privilege escalation or data breaches, repeated crashes could be exploited for denial-of-service (DoS) attacks, impacting service continuity. European organizations deploying Linux on MediaTek hardware should assess their exposure, especially in sectors where embedded Linux systems are prevalent. The lack of known exploits reduces immediate risk, but the potential for stability issues necessitates proactive mitigation to maintain operational resilience.

To mitigate CVE-2022-49496, European organizations should: 1) Verify and apply the latest Linux kernel updates from trusted sources or Linux distribution vendors that include the fix for the MediaTek vcodec driver. 2) If kernel updates are not immediately available, avoid unloading the mtk-vcodec-dec.ko module dynamically (i.e., avoid using rmmod on this module) to prevent triggering the crash. 3) For embedded or custom Linux systems, rebuild the kernel with the patched driver or disable the MediaTek vcodec driver if not required. 4) Implement monitoring for kernel panics and crashes related to module removal to detect potential exploitation or stability issues early. 5) Engage with hardware and software vendors to confirm the presence of patches and request timely updates. 6) In environments where MediaTek hardware is used, conduct thorough testing of kernel module operations during maintenance windows to avoid unexpected downtime. These steps go beyond generic advice by focusing on module-specific handling and operational practices tailored to this vulnerability.