CVE-2022-49759 is a vulnerability in the Linux kernel specifically affecting the VMware VMCI (Virtual Machine Communication Interface) driver component. The issue arises from the use of tasklets in the vmci_dispatch_dgs() function, which calls vmci_read_data(). This function uses wait_event(), a sleeping function, in an atomic context where sleeping is not allowed. Tasklets run in atomic context and must not invoke any functions that can sleep, as this leads to invalid sleep conditions and potential deadlocks. The kernel logs indicate that the vmtoolsd process encounters a BUG due to sleeping in atomic context, with a stack trace showing the problem originating from vmci_send_datagram and related VMCI functions. The fix involves replacing tasklets with threaded interrupts (threaded IRQs), which allow sleeping and thus prevent the deadlock scenario by removing the usage of tasklets entirely. This vulnerability can cause system instability or kernel panics when the VMCI driver is used, particularly in VMware virtualized environments running affected Linux kernel versions. There is no evidence of exploitation in the wild, and no CVSS score has been assigned yet. The vulnerability affects Linux kernel versions containing the vulnerable commit hashes referenced, and is relevant for systems running VMware tools or VMCI-enabled virtual machines.

For European organizations, the primary impact of CVE-2022-49759 is on the stability and availability of Linux systems running inside VMware virtualized environments that use the VMCI driver. This includes enterprise servers, cloud infrastructure, and development environments that rely on VMware virtualization with Linux guests. A deadlock or kernel panic caused by this vulnerability could lead to unexpected downtime, disruption of critical services, and potential data loss if systems crash during operations. Organizations with large VMware deployments or those using VMCI features for inter-VM communication are at higher risk. While this vulnerability does not directly expose confidentiality or integrity risks, the availability impact can be significant, especially for production workloads. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to accidental crashes or potential future exploitation if attackers find ways to trigger the deadlock deliberately.

To mitigate CVE-2022-49759, European organizations should: 1) Identify Linux systems running on VMware hypervisors that utilize the VMCI driver and VMware tools. 2) Apply the latest Linux kernel updates that include the fix replacing tasklets with threaded IRQs in the VMCI driver. This patch removes the invalid sleep condition and prevents deadlocks. 3) If immediate patching is not possible, consider disabling the VMCI driver or VMware tools features that rely on VMCI datagram communication as a temporary workaround, understanding this may reduce functionality. 4) Monitor system logs for kernel BUG messages related to vmci_guest.c or vmtoolsd crashes to detect potential triggering of this vulnerability. 5) Test patches in staging environments to ensure stability before production deployment. 6) Maintain updated VMware tools and hypervisor versions to ensure compatibility with patched Linux kernels. These steps go beyond generic advice by focusing on the specific driver and virtualization context involved.