CVE-2022-49539 is a vulnerability identified in the Linux kernel's rtw89 wireless driver, specifically related to the handling of CAM (Content Addressable Memory) entries during the system error recovery (SER) process at Layer 2 (L2) reset. CAM here refers to address CAM and BSSID CAM, which are used to manage wireless client associations and security contexts. The vulnerability arises because CAM entries are leaked during the L2 reset process and the ieee80211_restart_hw() function call, which is part of the hardware restart sequence. Normally, CAM entries are released before hardware restart only if the connection is secured. However, in non-secure connections, CAM entries are not properly released, causing memory leaks. The issue is compounded by multiple acquisitions of CAM entries without proper validation, leading to additional leaks. Furthermore, in Access Point (AP) mode, the address CAM of all connected stations is not released before hardware restart, which can exacerbate resource exhaustion. The fix involves releasing CAM entries regardless of connection security status to prevent leaks and adding checks to avoid multiple acquisitions of CAM entries. This vulnerability is primarily a resource management flaw that could lead to memory leaks in the wireless driver during error recovery and hardware restart sequences. There are no known exploits in the wild, and no CVSS score has been assigned yet.

For European organizations relying on Linux-based systems with wireless connectivity, especially those using devices with the rtw89 wireless driver (commonly found in certain Realtek Wi-Fi chipsets), this vulnerability could lead to resource exhaustion on affected devices. Memory leaks in CAM entries during error recovery and hardware restarts can degrade wireless performance, cause instability, or potentially lead to denial of service (DoS) conditions where wireless interfaces become unresponsive or fail to reconnect properly. This can impact critical infrastructure, enterprise networks, and industrial control systems that depend on reliable wireless communication. Although the vulnerability does not directly expose confidentiality or integrity risks, the availability impact could disrupt business operations, particularly in environments with high wireless usage or where frequent hardware resets occur. The lack of authentication or user interaction requirements means that the issue could be triggered by normal system operations or automated recovery processes, increasing the risk of impact without direct attacker intervention.

To mitigate this vulnerability, European organizations should prioritize updating their Linux kernel to the patched version that includes the fix for CVE-2022-49539. Specifically, ensure that the rtw89 wireless driver is updated to the version where CAM leaks are addressed. Network administrators should monitor wireless device logs for frequent L2 resets or hardware restart events that could indicate resource leaks. Implementing proactive wireless interface resets or reboots as a temporary workaround may help alleviate resource exhaustion until patches are applied. Additionally, organizations should audit their wireless infrastructure to identify devices using affected Realtek chipsets and consider temporary disabling or replacing vulnerable hardware if patching is not immediately feasible. For critical systems, isolating wireless networks or using wired alternatives during remediation can reduce the risk of service disruption. Finally, maintain up-to-date system monitoring and alerting to detect abnormal wireless interface behavior indicative of this vulnerability's impact.