CVE-2022-49760 is a vulnerability in the Linux kernel's memory management subsystem, specifically within the handling of huge pages (hugetlb) and userfaultfd write-protection (uffd-wp) in the function hugetlb_change_protection(). The issue arises when the kernel improperly manages page table entries (PTEs) that serve as markers during protection changes on huge pages. Two problematic scenarios are identified: (1) re-protecting a uffd-wp PTE marker using uffd-wp leads to corruption of the PTE marker, and (2) unprotecting a uffd-wp PTE marker results in stale PTE variables causing incorrect modification of the PTE marker. This mishandling can cause the kernel to treat corrupted PTE markers as valid present pages mapping to invalid memory, which can be triggered by operations such as mapping a memfd backed by huge pages, registering uffd-wp, and performing uffd-wp or uffd-unprotect operations multiple times. A subsequent fallocate system call with the PUNCH_HOLE flag on the affected file range can trigger a kernel BUG, leading to a kernel panic and system crash. The vulnerability is rooted in the complex interaction between huge page management, userfaultfd write-protection, and memory migration entries, with the kernel failing to correctly handle certain edge cases. The patch series referenced addresses these issues by correcting the PTE marker handling logic in hugetlb_change_protection(). No known exploits are reported in the wild, and the vulnerability requires specific conditions involving huge pages, userfaultfd write-protection, and file operations to be triggered. The vulnerability affects Linux kernel versions identified by the given commit hashes and is relevant to systems using huge pages with userfaultfd write-protection, commonly found in virtualization environments such as QEMU where virtio-mem and background snapshots are used.

For European organizations, this vulnerability poses a risk primarily to environments running Linux kernels with huge page support and userfaultfd write-protection enabled, especially in virtualization and cloud infrastructure contexts. The vulnerability can cause kernel panics and system crashes, leading to denial of service (DoS) conditions. This can disrupt critical services, particularly in data centers, cloud providers, and enterprises relying on virtual machines or containerized workloads that utilize huge pages for performance optimization. The impact on confidentiality and integrity is limited as the vulnerability does not directly enable privilege escalation or arbitrary code execution; however, the resulting instability and crashes can cause service outages and potential data loss if systems are not properly backed up or if critical processes are interrupted. Given the complexity and specific triggering conditions, exploitation requires privileged access or the ability to perform specific memory and file operations, reducing the likelihood of remote exploitation but increasing risk from insider threats or compromised systems. The vulnerability may also affect embedded systems or specialized appliances running affected Linux kernels, which are common in industrial and telecommunications sectors in Europe.

European organizations should prioritize patching affected Linux kernel versions with the fixes addressing hugetlb_change_protection() PTE marker handling. Specifically, kernel upgrades to versions including the referenced patch series should be deployed promptly in all environments using huge pages and userfaultfd write-protection. For virtualization platforms like QEMU, ensure that the host and guest kernels are updated to prevent triggering the vulnerability during memory snapshot or migration operations. Additionally, organizations should audit their use of huge pages and userfaultfd write-protection features, disabling or limiting these where not strictly necessary to reduce the attack surface. Monitoring kernel logs for VM_BUG_ON or kernel panic messages related to hugetlb or uffd-wp can help detect attempts to trigger this vulnerability. Implement strict access controls and privilege separation to prevent unauthorized users from performing the specific memory and file operations required to exploit this issue. Backup critical data regularly to mitigate potential data loss from unexpected system crashes. Finally, coordinate with Linux distribution vendors and virtualization software providers to ensure timely receipt of security updates and advisories.