Deadlock Issue in ath11k Management Frame Handling in Linux Kernel
Summary
CVE-2022-49123: In the Linux kernel, the following vulnerability has been resolved: ath11k: Fix frames flush failure caused by deadlock We are seeing below warnings: kernel: [25393.301506] ath11k_pci 0000:01:00.0: failed to flush mgmt t... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The ath11k driver is responsible for managing Qualcomm Atheros 802.11ax wireless devices, enabling high-performance wireless networking. This driver is crucial for maintaining stable connections and efficient data transmission. However, a vulnerability has been identified that can lead to deadlock situations, affecting the performance and reliability of wireless communications.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49123, arises from a failure in the ath11k driver to flush management frames due to a deadlock condition. This situation occurs when the wmi_mgmt_tx_work task is unable to execute for an extended period, leading to blocked tasks and potential system instability. The kernel logs indicate that the management transmit queue fails to flush, resulting in dropped management frames. If exploited, this vulnerability can lead to degraded network performance, connection drops, and increased latency in wireless communications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can adjust the hung task timeout settings by executing the following commands in the terminal: echo 20 > /proc/sys/kernel/hung_task_timeout_secs and echo 50 > /proc/sys/net/wireless/ATH11K_FLUSH_TIMEOUT. This will increase the timeout values and may help mitigate the impact of the deadlock issue until a proper fix is applied.
Conclusion
CVE-2022-49123 is a significant vulnerability affecting the ath11k driver in the Linux kernel, leading to potential deadlock situations and degraded wireless performance. Users are advised to update their kernel to the latest patched version to ensure system stability and security. Temporary workarounds are available, but applying the patch is the recommended solution.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49123 is a vulnerability in the Linux kernel's ath11k driver that can cause deadlock situations, leading to management frame handling failures.
This vulnerability can lead to dropped management frames, degraded network performance, and increased latency in wireless communications.
Yes, the patched version of the Linux kernel is 5.17.3-1. Users should update their systems to this version to mitigate the vulnerability.
As a temporary measure, you can adjust the hung task timeout settings to reduce the impact of the deadlock issue until you can apply the patch.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
