CVE-2022-49519 is a vulnerability in the Linux kernel's ath10k wireless driver, specifically affecting the handling of firmware (FW) recovery and suspend events. The issue arises when a firmware recovery, triggered by a WMI timeout or crash, occurs concurrently with an immediate suspend event. During FW recovery, the ath10k_core_restart() function initiates driver cleanup via ath10k_halt(). If a suspend event happens during this recovery, the restart worker thread is frozen until suspend completes. The suspend event triggers ath10k_stop(), which again calls ath10k_halt(). This double invocation of ath10k_halt() leads to ath10k_htt_rx_free() being called twice without a corresponding allocation, causing a double free condition and subsequent kernel crash. The crash manifests as a kernel BUG in the memory allocator (slub.c), resulting in invalid opcode exceptions and system instability. The fix implemented skips the call to ath10k_halt() during suspend if the driver state is ATH10K_STATE_RESTARTING and ensures proper synchronization by calling ath10k_wait_for_suspend() to wait for suspend completion. The frozen restart worker thread is cancelled during resume to prevent lingering issues. This vulnerability specifically affects devices using the Qualcomm Atheros QCA6174 wireless chipset and similar hardware running affected Linux kernel versions. The root cause is a race condition between firmware recovery and suspend operations leading to double free memory corruption and kernel panic.

For European organizations, this vulnerability poses a risk of denial of service (DoS) on systems running affected Linux kernels with ath10k wireless drivers, particularly those using Qualcomm Atheros QCA6174 or related chipsets. The kernel crash can cause system instability, unexpected reboots, or complete loss of wireless connectivity. This can disrupt critical network services, especially in environments relying on Linux-based infrastructure such as servers, embedded devices, IoT gateways, and network appliances. The vulnerability does not appear to allow privilege escalation or remote code execution directly but can be exploited to cause persistent DoS conditions. Organizations with wireless infrastructure or devices using affected drivers may face operational disruptions, impacting availability and potentially leading to downtime in business-critical applications. The risk is heightened in environments where suspend/resume cycles are frequent, such as laptops, mobile devices, or energy-saving server configurations. Although no known exploits are reported in the wild, the vulnerability's nature as a kernel-level double free crash makes it a significant stability concern.

1. Update Linux kernels to versions where this vulnerability is patched. Apply vendor-supplied kernel updates or mainline Linux kernel patches that include the fix for CVE-2022-49519. 2. For systems where immediate patching is not feasible, consider disabling suspend/resume functionality or avoid triggering suspend events during firmware recovery periods to reduce the race condition window. 3. Monitor system logs for kernel BUG messages or crashes related to ath10k to detect potential exploitation or instability. 4. In embedded or custom Linux environments, review and backport the patch that skips ath10k_halt() during suspend when the driver state is ATH10K_STATE_RESTARTING and ensures proper synchronization with ath10k_wait_for_suspend(). 5. Test wireless driver stability after patching in controlled environments before wide deployment to ensure no regressions. 6. Employ robust system monitoring and automated reboot mechanisms to recover from unexpected kernel crashes if they occur before patching. 7. Engage with hardware vendors to confirm affected device models and firmware versions, ensuring comprehensive coverage of the fix.