CVE-2022-49647 is a high-severity vulnerability in the Linux kernel's cgroup subsystem related to task migration across control groups (csets). The issue arises from the way the kernel manages internal data structures during migration of tasks between cgroups. Specifically, the kernel uses a single node (cset->mg_preload_node) to track both source and destination cgroups during migration. This design assumes a cgroup cannot be both source and destination simultaneously. However, in scenarios involving multiple threads where some perform identity migrations (no actual move) and others move across cgroups, this assumption breaks down. The reuse of the same node for both source and destination lists leads to improper reference counting and premature removal of cgroups from tracking lists. Consequently, if all tasks leave a source cgroup before migration completes and an incoming task pins it, the cgroup can be destroyed prematurely, resulting in a use-after-free condition. This memory corruption flaw could be exploited by a local attacker with limited privileges (requires local privileges and no user interaction) to escalate privileges or cause denial of service by crashing the kernel. The patch resolves this by splitting the single mg_preload_node into separate mg_src_preload_node and mg_dst_preload_node nodes, preventing interference between source and destination preload lists and ensuring proper lifecycle management of cgroups during migration. The vulnerability is identified as CWE-416 (Use After Free) and has a CVSS v3.1 score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Exploitation requires local access and privileges but no user interaction, making it a significant risk for multi-user Linux systems or container environments relying on cgroups for resource management.

For European organizations, this vulnerability poses a critical risk especially in environments heavily reliant on Linux servers, container orchestration platforms (e.g., Kubernetes), and multi-tenant systems where cgroups are extensively used for resource isolation and management. Exploitation could allow attackers to escalate privileges locally, potentially gaining root access or causing kernel crashes leading to denial of service. This can disrupt critical services, compromise sensitive data, and impact business continuity. Organizations running cloud infrastructure, hosting providers, and enterprises using Linux-based virtualization or containerization technologies are particularly vulnerable. The flaw could be leveraged to bypass security boundaries between containers or user namespaces, undermining isolation guarantees. Given the widespread use of Linux in European data centers and critical infrastructure, the vulnerability could have broad operational and security impacts if left unpatched.

1. Apply the official Linux kernel patches that separate mg_preload_node into mg_src_preload_node and mg_dst_preload_node as soon as they become available from trusted sources or Linux distribution vendors. 2. Prioritize patching in environments running multi-threaded applications with complex cgroup migrations, such as container orchestration platforms or systems using advanced resource control features. 3. Implement strict access controls and monitoring on cgroup management interfaces (e.g., /sys/fs/cgroup) to restrict unprivileged users from performing cgroup migrations. 4. Employ kernel live patching solutions where possible to minimize downtime while applying fixes. 5. Monitor kernel logs and system behavior for anomalies indicative of exploitation attempts, such as unexpected kernel crashes or suspicious cgroup migration activities. 6. Conduct thorough testing of patched kernels in staging environments to ensure stability before production deployment. 7. Educate system administrators about the risks of local privilege escalation via kernel vulnerabilities and enforce least privilege principles for users with cgroup management capabilities.