CVE-2022-49624

Q: What is the severity of CVE-2022-49624?

CVE-2022-49624 has a CVSS score of 5.5 (MEDIUM). This vulnerability in the Linux kernel's Atlantic network driver causes a system hang when resuming from S3 sleep state due to improper cleanup function calls. It affects systems using the atlantic network driver, primarily those with Qualcomm/Aquantia network cards that suspend/resume functionality. The issue leads to denial of service during system resume operations.

5.5 MEDIUM

📋 TL;DR

This vulnerability in the Linux kernel's Atlantic network driver causes a system hang when resuming from S3 sleep state due to improper cleanup function calls. It affects systems using the atlantic network driver, primarily those with Qualcomm/Aquantia network cards that suspend/resume functionality. The issue leads to denial of service during system resume operations.

💻 Affected Systems

Products:

Linux kernel with atlantic network driver

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Qualcomm/Aquantia network cards using the atlantic driver and using suspend/resume functionality.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes completely unresponsive during resume from sleep, requiring hard reboot and potentially causing data loss or filesystem corruption.

🟠

Likely Case

System hangs when resuming from S3 sleep state, requiring manual power cycle and interrupting normal operations.

🟢

If Mitigated

No impact if systems don't use suspend/resume functionality or if patched kernel is used.

🌐 Internet-Facing: LOW - This is a local driver issue requiring physical or privileged access to trigger via suspend/resume.

🏢 Internal Only: MEDIUM - Internal systems using affected network cards and suspend functionality could experience service disruption.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simply suspending and resuming the system triggers the issue

This is a reliability bug rather than a security vulnerability that can be exploited for privilege escalation or remote access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 2e15c51fefaffaf9f72255eaef4fada05055e4c5, 58c90993933e7a76305519bc70da8c0cd2907c1f, 702419db7ded2e3686fbc05040b61d7428d611d5, or c2978d0124f26e453ed30fda6a37f62d8c7f19cb

Vendor Advisory: https://git.kernel.org/stable/c/2e15c51fefaffaf9f72255eaef4fada05055e4c5

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable suspend/resume functionality

linux

Prevent system from entering S3 sleep state to avoid triggering the bug

echo 'deep' > /sys/power/mem_sleep
systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

Blacklist atlantic driver

linux

Prevent loading of vulnerable driver (will disable network functionality for affected cards)

echo 'blacklist atlantic' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Disable system suspend functionality entirely
Replace affected network hardware with different brand/model

🔍 How to Verify

Check if Vulnerable:

Check if atlantic module is loaded and kernel version is before fix: lsmod | grep atlantic && uname -r

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits or test suspend/resume functionality after patch

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing 'PM: failed to resume async: error -110'
Call traces involving aq_nic_deinit during resume

Network Indicators:

None - this is a local system issue

SIEM Query:

source="kernel" AND "PM: failed to resume async: error -110" OR "aq_nic_deinit"

📊 Metadata

CVE ID: CVE-2022-49624

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.07% exploit probability (20.8th percentile)

Published: February 26, 2025

Last Updated: October 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable suspend/resume functionality

Blacklist atlantic driver

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export