CVE-2022-49131: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was identified and resolved in the ath11k driver that could cause a kernel panic during unload/load operations of ath11k modules. The issue was assigned CVE-2022-49131 and affected Linux kernel versions from 5.16 through 5.16.20, 5.17 through 5.17.3, and 5.11 through 5.15.34 (NVD).

The vulnerability occurred due to improper handling of NAPI (New API) structures during module unload operations. Specifically, the issue arose because netifnapidel() was not being called from ath11kahbfreeextirq(), leading to a kernel paging request at an invalid virtual address. This resulted in an internal error (Oops) on ARM-based systems. The CVSS v3.1 base score for this vulnerability is 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability could cause a kernel panic, leading to system instability and potential denial of service. The issue specifically manifests when repeatedly unloading and loading the ath11k modules (Kernel Patch).

The vulnerability was fixed by adding a call to netifnapidel() in the ath11kahbfreeextirq() function. The fix was implemented in multiple kernel versions through backporting. Users should update to patched kernel versions: beyond 5.16.20, 5.17.3, or 5.15.34 (NVD).