CVE-2022-49695 is a high-severity use-after-free vulnerability in the Linux kernel's igb network driver, specifically within the igb_clean_tx_ring function. This vulnerability arises when the Intel Gigabit Ethernet (igb) network interface card (NIC) operates in eXpress Data Path (XDP) mode. The bug is triggered by redirecting network traffic into the igb NIC and then closing the device while traffic is still flowing. The use-after-free condition occurs because the driver attempts to clean the transmit ring buffer after the device has been closed, leading to a reference to freed memory. This can cause kernel crashes (denial of service) or potentially allow an attacker to execute arbitrary code in kernel context due to memory corruption. The vulnerability affects Linux kernel versions including 5.18.3 and likely others where the igb driver and XDP support are present. The provided kernel trace log shows the crash occurring in refcount_warn_saturate, indicating a reference count mismanagement leading to the use-after-free. The CVSS 3.1 score is 7.8 (high), reflecting the local attack vector requiring low privileges but no user interaction, with high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The vulnerability is classified under CWE-416 (Use After Free).

For European organizations, this vulnerability poses a significant risk particularly to those relying on Linux servers with Intel igb NICs operating in XDP mode. The impact includes potential kernel panics causing denial of service, which can disrupt critical network services and infrastructure. More severe exploitation could lead to privilege escalation or arbitrary code execution at the kernel level, compromising system confidentiality and integrity. This is especially critical for data centers, cloud providers, telecom operators, and enterprises running network-intensive Linux workloads. Given the widespread use of Linux in European government, finance, and industrial sectors, exploitation could lead to service outages, data breaches, or lateral movement within networks. The requirement for local privileges limits remote exploitation but insider threats or compromised accounts could leverage this vulnerability. The absence of known exploits reduces immediate risk but patching is essential to prevent future attacks.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Specifically, ensure that the igb driver and XDP components are updated to the latest stable releases provided by their Linux distribution vendors. Network administrators should audit systems using Intel igb NICs in XDP mode and consider temporarily disabling XDP offloading if patching is delayed. Implement strict access controls to limit local user privileges and monitor for unusual network device closures or crashes indicative of exploitation attempts. Employ kernel crash monitoring and logging to detect potential exploitation. For environments using custom or embedded Linux kernels (e.g., in telecom or industrial equipment), coordinate with vendors to obtain patched firmware or kernel updates. Additionally, conduct vulnerability scanning and penetration testing focusing on local privilege escalation vectors to identify susceptible systems.