CVE-2022-49911 is a vulnerability identified in the Linux kernel's netfilter ipset subsystem, specifically affecting the hash:net,iface type. The ipset subsystem is used to manage IP sets for firewall rules and network filtering. The vulnerability arises because the system does not enforce the documented limit on the number of different interfaces that can be associated with the same network prefix in a single set. This omission allows an attacker or misconfigured system to add the same network prefix with more than 64 different interfaces, which leads to excessive memory allocation requests. The excessive memory allocation can cause the kernel to fail vmalloc calls, resulting in allocation failures and potentially leading to denial of service (DoS) conditions due to resource exhaustion. The issue is reproducible by creating a large ipset with a high hashsize and adding multiple entries of the same network prefix with different interface identifiers. The kernel logs show vmalloc errors and stack traces indicating memory allocation failures. The fix implemented enforces the limit of no more than 64 different interfaces per network prefix in a single ipset, as documented in the ipset manpage. This prevents the creation of excessively large data structures and mitigates the risk of memory exhaustion. No known exploits in the wild have been reported, and no CVSS score has been assigned yet. The vulnerability primarily impacts Linux systems using ipset with the hash:net,iface type, which is common in firewall and network filtering configurations.

For European organizations, the impact of CVE-2022-49911 could be significant in environments where Linux-based firewalls or network filtering systems rely on ipset with the hash:net,iface type. Exploitation of this vulnerability could lead to denial of service conditions by exhausting kernel memory resources, causing network filtering services to fail or degrade. This could disrupt critical network security controls, potentially allowing unauthorized traffic or causing outages in protected services. Organizations with complex network segmentation or multi-interface setups are more likely to use such ipsets and thus face higher risk. The impact is primarily on availability and system stability rather than confidentiality or integrity. However, the resulting downtime or degraded network security posture could indirectly affect data protection and compliance obligations under European regulations such as GDPR. Since Linux is widely used in European enterprise, government, and telecom infrastructure, the vulnerability could affect a broad range of sectors. The lack of known exploits reduces immediate risk, but the potential for DoS attacks in critical network infrastructure warrants prompt attention.

European organizations should take the following specific mitigation steps: 1) Apply the latest Linux kernel updates that include the fix enforcing the 64-interface limit per network prefix in ipset. 2) Audit existing ipset configurations to identify any sets using hash:net,iface type and verify they comply with the documented limits. 3) Implement monitoring of kernel logs for vmalloc errors or ipset-related warnings that could indicate attempted exploitation or misconfiguration. 4) Limit administrative access to ipset configuration tools to trusted personnel to prevent accidental or malicious creation of large ipsets. 5) In environments with automated configuration management, add validation checks to prevent creation of ipsets exceeding the documented limits. 6) Consider network segmentation and firewall design to minimize reliance on large ipsets with multiple interfaces. 7) Engage with Linux distribution vendors or security mailing lists to stay informed about patches and advisories related to this vulnerability. These steps go beyond generic advice by focusing on configuration auditing, monitoring, and operational controls specific to ipset usage.