CVE-2022-48704 is a vulnerability identified in the Linux kernel's Radeon DRM (Direct Rendering Manager) driver, which manages AMD Radeon graphics cards. The issue arises from an incomplete flush of the Radeon lockup work queue during GPU suspend operations. Specifically, while the Radeon driver fences and waits for the GPU to finish processing current batch rings, there exists a corner case where the lockup work queue is not fully flushed before the radeon_suspend_kms() function invokes pci_set_power_state() to transition the device into the D3hot power state. According to PCI specification revision 4.0, in the D3hot state, only Configuration and Message requests are accepted by the device function; all other requests must be treated as unsupported or unexpected. Failure to properly flush the work queue can lead to kernel paging faults and crashes, as evidenced by kernel oops logs showing invalid memory accesses during the si_gpu_check_soft_reset and si_dma_is_lockup routines. This results in system instability and potential denial of service. The root cause is a race condition between GPU suspend operations and pending work queue tasks that are not properly synchronized before power state changes. The fix involves forcing a flush of the lockup work queue to ensure all GPU-related tasks complete before the device enters the low power state, preventing invalid memory accesses and kernel panics. This vulnerability affects Linux kernel versions containing the specified commit hashes and impacts systems using Radeon GPUs with the affected driver code. No known exploits are reported in the wild as of the publication date, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux with AMD Radeon graphics hardware, including servers, desktops, and embedded devices. The impact includes potential system crashes and denial of service due to kernel panics triggered by the improper handling of GPU suspend operations. Organizations relying on Linux-based infrastructure with Radeon GPUs may experience unexpected downtime, affecting business continuity and operational stability. Critical sectors such as finance, healthcare, manufacturing, and public services that utilize Linux servers or workstations with Radeon GPUs could face disruptions. Additionally, the vulnerability could be exploited indirectly by triggering system instability through crafted workloads or power state transitions, although no active exploits are known. The lack of authentication or user interaction requirements means that local attackers or malicious software with kernel-level access could trigger the issue. While this vulnerability does not directly lead to privilege escalation or data leakage, the resulting denial of service could be leveraged as part of a broader attack strategy to disrupt services or cause operational delays.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched, ensuring the Radeon DRM driver includes the forced flush fix for the lockup work queue. System administrators should: 1) Monitor and apply Linux kernel updates from trusted sources promptly, especially those related to the Radeon driver and power management subsystems. 2) Audit systems to identify the presence of affected Radeon GPUs and kernel versions using the specified commit hashes or release notes. 3) Implement kernel crash monitoring and alerting to detect early signs of this issue, enabling rapid response to potential system instability. 4) For critical systems, consider temporarily disabling GPU suspend features or configuring power management settings to avoid entering the D3hot state until patches are applied. 5) Engage with hardware vendors and Linux distribution maintainers to verify that patched kernel versions are available and tested for their environments. 6) Incorporate this vulnerability into vulnerability management and patching workflows to ensure ongoing compliance and risk reduction. These steps go beyond generic advice by focusing on targeted patching, system auditing, and operational adjustments specific to the Radeon GPU power management context.