LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING

In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls driver clean up via ath10k_halt(). When the suspend event occurs between the FW recovery, the restart worker thread is put into frozen state until suspend completes. The suspend event triggers ath10k_stop() which again triggers ath10k_halt() The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be called twice(Note: ath10k_htt_rx_alloc was not called by restart worker thread because of its frozen state), causing the crash. To fix this, during the suspend flow, skip call to ath10k_halt() in ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. Also, for driver state ATH10K_STATE_RESTARTING, call ath10k_wait_for_suspend() in ath10k_stop(). This is because call to ath10k_wait_for_suspend() is skipped later in [ath10k_halt() > ath10k_core_stop()] for the driver state ATH10K_STATE_RESTARTING. The frozen restart worker thread will be cancelled during resume when the device comes out of suspend. Below is the crash stack for reference: [ 428.469167] ------------[ cut here ]------------ [ 428.469180] kernel BUG at mm/slub.c:4150! [ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 428.469219] Workqueue: events_unbound async_run_entry_fn [ 428.469230] RIP: 0010:kfree+0x319/0x31b [ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 [ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 [ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 [ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 [ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 428.469285] Call Trace: [ 428.469295] ? dma_free_attrs+0x5f/0x7d [ 428.469320] ath10k_core_stop+0x5b/0x6f [ 428.469336] ath10k_halt+0x126/0x177 [ 428.469352] ath10k_stop+0x41/0x7e [ 428.469387] drv_stop+0x88/0x10e [ 428.469410] __ieee80211_suspend+0x297/0x411 [ 428.469441] rdev_suspend+0x6e/0xd0 [ 428.469462] wiphy_suspend+0xb1/0x105 [ 428.469483] ? name_show+0x2d/0x2d [ 428.469490] dpm_run_callback+0x8c/0x126 [ 428.469511] ? name_show+0x2d/0x2d [ 428.469517] __device_suspend+0x2e7/0x41b [ 428.469523] async_suspend+0x1f/0x93 [ 428.469529] async_run_entry_fn+0x3d/0xd1 [ 428.469535] process_one_work+0x1b1/0x329 [ 428.469541] worker_thread+0x213/0x372 [ 428.469547] kthread+0x150/0x15f [ 428.469552] ? pr_cont_work+0x58/0x58 [ 428.469558] ? kthread_blkcg+0x31/0x31 Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49519 is a Linux kernel crash bug in the ath10k Wi-Fi driver. A firmware recovery occurring just before system suspend can cause cleanup to run twice, leading to a double-free and kernel crash. Business impact is mainly endpoint or device availability, especially on systems using affected Qualcomm Atheros ath10k wireless hardware.

Executive priority

Treat as a targeted availability risk, not an emergency internet-facing exposure based on current evidence. Patch through normal kernel maintenance, prioritizing fleets with ath10k wireless hardware and suspend/resume use. Escalate if affected devices show crashes or operational instability.

Technical view

The ath10k driver can call ath10k_halt() during firmware recovery and again during suspend via ath10k_stop(). If the restart worker is frozen during suspend, ath10k_htt_rx_free() may run twice without a matching reallocation, triggering a kernel BUG in kfree(). The fix skips ath10k_halt() during suspend when the driver state is ATH10K_STATE_RESTARTING.

Likely exposure

Exposure appears limited to Linux systems using the ath10k Wi-Fi driver, with the issue tested on QCA6174 hardware. The source lists Linux kernel versions including 3.11, 5.10.121, 5.15.46, 5.17.14, 5.18.3, and 5.19 as affected, but distribution-specific status requires vendor confirmation.

Exploitation context

The public sources describe a crash during a race between ath10k firmware recovery and immediate system suspend. They do not report active exploitation, remote exploitability, privilege escalation, or CISA KEV listing. Practical impact is a denial-of-service condition on affected systems under specific timing and hardware conditions.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit report, or KEV entry is provided. The vulnerability is a race-driven double-free crash in ath10k suspend/restart handling; affected distribution kernels may vary because Linux vendors frequently backport fixes.

Mitigation direction

  • Update to a kernel containing the referenced ath10k stable fixes.
  • Check your Linux distribution’s advisory for backported fixes.
  • Prioritize laptops or embedded devices using ath10k Wi-Fi and suspend/resume.
  • If updates are unavailable, follow vendor guidance for operational workarounds.

Validation and detection

  • Inventory systems using the ath10k Wi-Fi driver.
  • Confirm kernel package includes the referenced stable fix commits.
  • Review kernel logs for ath10k suspend or kfree crash traces.
  • Test suspend and resume after patching on representative hardware.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49519 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5, 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5, 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5, 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5, 5e3dd157d7e70f0e3cea3f2573ed69fb156a19d5unaffected
LinuxLinux3.11, 0, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.