CVE-2022-49781 is a vulnerability in the Linux kernel's performance monitoring unit (PMU) code specific to AMD processors, particularly in the perf subsystem's handling of non-maskable interrupts (NMIs). The flaw arises from a race condition between the amd_pmu_enable_all() function and the perf NMI handler. Specifically, amd_pmu_enable_all() iterates over active performance events and enables them one by one. However, a perf NMI for another event can interrupt this process. The NMI handler disables and re-enables all events, including the one currently being enabled by amd_pmu_enable_all(). If the re-enabled event has a very low sampling period, it can trigger immediate successive NMIs, causing the event to be throttled and cleared from the active mask and event list by x86_pmu_stop(). When amd_pmu_enable_all() resumes, it attempts to enable an event that has been cleared, resulting in a NULL pointer dereference and a kernel crash. This bug leads to a denial of service (DoS) condition by crashing the kernel due to a NULL pointer dereference triggered by race conditions in PMU event handling. The root cause is the interaction between the perf NMI handler and amd_pmu_enable_all(), which was recently modified to enable Branch Record Store (BRS) support. The suggested fix involves disabling BRS at the start of the NMI handler and re-enabling it upon exit to prevent enabling events that are not yet fully active in hardware, thereby avoiding the race condition. This vulnerability affects Linux kernel versions containing the specified commit hashes and is specific to AMD PMU event handling on x86 architectures.

For European organizations relying on Linux systems with AMD processors, this vulnerability can cause unexpected kernel crashes leading to system downtime and denial of service. This is particularly critical for infrastructure providers, cloud services, and enterprises running performance monitoring or profiling tools that utilize the perf subsystem. The impact includes potential disruption of critical services, loss of availability, and operational interruptions. While the vulnerability does not directly lead to privilege escalation or data leakage, the resulting kernel panic can affect system stability and availability, which is crucial for sectors such as finance, healthcare, telecommunications, and government services in Europe. Systems performing intensive performance monitoring or profiling are at higher risk. Additionally, the lack of known exploits in the wild currently reduces immediate risk, but the complexity of the bug and its kernel-level nature mean that exploitation could be automated in the future, increasing risk to European organizations that do not patch promptly.

European organizations should promptly apply the Linux kernel patches that address this race condition in the perf subsystem. Since the vulnerability arises from a race condition in the AMD PMU event handling, updating to a kernel version that includes the fix or backporting the patch is essential. Organizations should audit their use of perf and related performance monitoring tools, especially those configured with low sampling periods or aggressive profiling settings, as these increase the likelihood of triggering the bug. Temporarily disabling Branch Record Store (BRS) support in the perf NMI handler, if feasible, can serve as a workaround until patches are applied. Additionally, monitoring kernel logs for perf-related errors or crashes can help detect attempts to trigger this vulnerability. For critical systems, consider isolating performance monitoring workloads or limiting access to perf interfaces to trusted administrators to reduce the attack surface. Finally, ensure robust kernel crash recovery and system monitoring to minimize downtime in case of unexpected crashes.