CVE-2022-49130 is a vulnerability identified in the Linux kernel's ath11k wireless driver, specifically related to the MHI (Modem Host Interface) power-up sequence. The issue arises when the amss.bin firmware file is missing, causing the ath11k driver to crash during the removal of the ath11k_pci module (rmmod operation). The root cause is the use of an asynchronous power-up function (mhi_async_power_up()) that does not verify error conditions, leading to a null pointer dereference and a general protection fault in kernel space. The fix involves switching to a synchronous power-up function (mhi_sync_power_up()) that properly checks for errors, preventing the crash. The vulnerability manifests as a kernel crash (general protection fault) due to dereferencing a null pointer when the driver attempts to access hardware registers without the required firmware loaded. This can cause a denial of service (DoS) by crashing the kernel or causing instability. The vulnerability was observed on Intel NUC hardware running Linux kernel version 5.16.0-wt-ath+ with ath11k driver versions tied to specific git commit hashes. The vulnerability does not appear to require user interaction or authentication beyond the ability to remove the kernel module, which typically requires root privileges. No known exploits are reported in the wild, and no CVSS score has been assigned. The issue is technical and specific to the ath11k wireless driver handling Qualcomm WCN6855 hardware or similar chipsets using the MHI interface. The vulnerability is primarily a stability and availability concern due to kernel crashes triggered by missing firmware files during module removal.

For European organizations, the impact of CVE-2022-49130 centers on system availability and stability, particularly for those using Linux systems with Qualcomm ath11k wireless chipsets (e.g., WCN6855) in their infrastructure or endpoint devices. A successful trigger of this vulnerability can cause kernel crashes leading to denial of service, potentially disrupting critical network connectivity and operations. This is especially relevant for organizations relying on Linux-based wireless networking in environments such as enterprise offices, data centers, or industrial control systems. While exploitation requires root privileges to remove the kernel module, the vulnerability could be leveraged by attackers who have already gained elevated access to cause system instability or to cover tracks by forcing reboots. The lack of user interaction requirement means automated scripts or malware with root access could trigger the crash. However, the absence of known exploits and the technical nature of the flaw limit its immediate threat level. Still, organizations with Linux systems running affected kernel versions and ath11k drivers should consider the risk of unexpected outages and potential operational disruption.

1. Ensure Linux systems are updated to kernel versions where this vulnerability is patched, specifically where the ath11k driver uses mhi_sync_power_up() instead of the asynchronous variant. 2. Verify that the required firmware files (amss.bin) for Qualcomm ath11k wireless devices are correctly installed and accessible to prevent triggering the crash due to missing firmware. 3. Restrict root-level access to trusted administrators only, minimizing the risk of malicious module removal or manipulation. 4. Implement monitoring and alerting for kernel module removals and system crashes to detect potential exploitation attempts early. 5. For critical systems, consider isolating or limiting the use of affected wireless hardware until patches are applied. 6. Review and harden system configurations to prevent unauthorized module unloading or kernel manipulation. 7. Maintain an inventory of hardware and driver versions to quickly identify systems at risk and prioritize patching efforts.